Hacker News new | ask | show | jobs
by bhawks 1565 days ago
The browser security model is trivially defeated without the usage of https. IT is not an orthogonal or unrelated feature.

Making all new API development available only when content is delivered via a mechanism that provides the foundation for the rest of web security is good engineering practice.