I don't happen to have any data on that, but if it was the pedestrians at fault, then one might expect a similar spike in sidewalk accidents, which we haven't seen....

You're assuming that it's the pedestrians who are at fault in not looking where they are going, but it's more likely that it's car drivers using phones and not concentrating on what's happening on the road. Unfortunately, idiots in cars don't tend to die when they make stupid mistakes - it's the people around them.

Fair enough. Luckily, phishers don't bother with a non-javascript login page even though it is possible.

Yes, you are technically correct. However, every phishing site that I've ever seen does exactly zero without javascript enabled. If you've already visited paypal and whitelisted it in NoScript, then you'll immediately notice when you go to a similar site that isn't whitelisted and know not to put in any credentials.

You're suggesting that as well as verifying the identity of a domain owner, that the CA must identify any similarity to already existing domains and not allow any that are arbitrarily too similar. That's just retarded.

Except that they don't. Unless you can show me an example where they don't use any javascript in a login page.

But the certificate does authenticate that the domain in your browser URL bar is owned/controlled by the owner of the certificate. The fact that you are going to a different domain than the one that you expected is nothing to do with HTTPS. The whole point of a CA is to provide a certificate to legitimate owners of the domains. The point of a CA is NOT to determine that such-and-such domain is mistaken with another domain because the user is stupid.

You are entirely misunderstanding how SSL certificates work. LetsEncrypt allows the owner/administrator of domains to get and use a free SSL certificate and there is nothing to suggest that they are giving out certificates to non-owners of the relevant domains. The fact that you confuse paypal.com with playpal.com is not a problem with SSL encryption.

NoScript. You enable javascript for paypal.com and then anytime you visit paypall.com, your browser sits there not running any javascript.

The identity of the endpoint is shown in the browser URL. To prevent a MITM attack, I recommend using NoScript, so you can enable javascript on paypal.com, and your browser will then not run javascript on phisingpaypal.com without the user enabling it.

Guess who can't do research?

http://www.thetimes.co.uk/arti...

I was thinking more in terms of practicality - give it 50 years and most proprietary systems are dead in the water. Long term thinking is essential for any kind of long term archiving otherwise you'll just end up transferring the data around every 5-10 years.

The best bet is to go with already tested open standards that anyone can implement, test and evaluate.

It might not be the drivers' intentions to reduce highway capacity, but driving on a highway DOES reduce capacity for everyone else (to the tune of one vehicle). In large numbers, drivers can completely clog a road/highway and they then start complaining about there not being enough capacity for them all without realising that they are part of the problem.

It's not generally a good idea using trade secret and patent protected products for long term data archival. Eventually, the patents will expire, but in the short term, it restricts people from implementing and testing it and so you'll probably only discover the issues after it's too late.