Trusted Browser

Full Title or Meme

The best User Agent on an internet connected device is a User Trusted Browser to work only in the user's best interests.

Context

Currently nearly all HTTP traffic is initialized by 4 browsers, all of which are tracked within the [blink-dev@chromium.org blink dev community]. The primary source code repos are chromium (Google) and web-kit (Apple).

Problems

• The User Agent string provided by the browser in the HTTP header is used now simply to give the web server information on what sort of HTML it can process. It is routinely spoofed and has no security capability what-so-ever.
• The makers of Smart Phone browsers are working to improve the security of the browser experience, details are shown in the following section.

Solutions

• Same-site policy has been added and slowly enhanced to block cross-site scripting attacks (CSRF or XSRF) by asserting that a particular cookie should only be sent with requests initiated from the same registrable domain. This site describes the varying impact that this policy has on users on the various browsers. The challenge for [Single Sign On]] efforts with a Identifier or Attribute Provider at a different site than the Relying Party is that they rely on cross-site cookies to pass user credentials from one site to another. The problem introduced with iOS 12 from Apple is described on this site.

The following proposals are being evaluated:

• New browser based on Blink
• Align with some existing browser that want to be considered the best
• Browser extension
• Read evefy img on the page to see if it should be considered a trustmark
• New element, tag on img (attribute or method)

References

• OWASP
• Safe Browsing (Google)
• Best Web Browser: 6 web browsers tested for features, privacy and battery life
• The best secure browsers 2018 (Tech World)