Imagine if HTTP explicitly documented as part of the standard that the “User-Agent” header, when provided, must include a tamper-proof cryptographic signature that allows to securely identify which browser version the user has (with a consortium maintaining a list of registered browsers) so that websites can reject access if you are not using a browser they trust or they don’t like that your browser is too old…
Considering how much abuse there has been with the User-Agent header… I can’t imagine it being a good idea to include such a thing in the standard.
If on creation HTTP had included things like that, then I think Gopher and other competitors at the time might not have been a bad option, honestly.
Imagine if HTTP explicitly documented as part of the standard that the “User-Agent” header, when provided, must include a tamper-proof cryptographic signature that allows to securely identify which browser version the user has (with a consortium maintaining a list of registered browsers) so that websites can reject access if you are not using a browser they trust or they don’t like that your browser is too old…
Considering how much abuse there has been with the User-Agent header… I can’t imagine it being a good idea to include such a thing in the standard.
If on creation HTTP had included things like that, then I think Gopher and other competitors at the time might not have been a bad option, honestly.
I don’t see your point I’m sorry. This would make it easier for Google to exclude small competitors.
The point is that not all protocols are created equal. So “we shouldn’t have created HTTP” depends on what HTTP is specifying.
If a protocol makes it easier for big players to abuse the system, then it’s a worse protocol in that respect.
The point being made against passkeys is that, in some respects, it’s worse because of the inclusion of attestation as part of the standard.