Who thinks this is a good idea for online banking?
Crypto seems too absolutist for this use case. (Although I should mention that they seem to discuss rolling back the blockchain whenever a big heist takes place. But if you can rollback then chain, then doesn't that circumvent the core tenant of no trust needed as now you have to trust that the group doesn't decide to rollback the chain?)
Who decides what is a "whoopsy" a legitimate user made, and what is a pretend-"whoopsy" conjured by a malicious actor? Giving people & automated systems ability to flag something as "whoopsy" and revert it or lock down entire account enables malicious abuse and honest mistakes; either can end up very costly or even effectively irreversible in some cases.
Trivial example: every day we see a new post on HN about somebody's Apple/Google/YT/payment processor/etc operation/content/account being marked as "whoopsy" by the support or anti-fraud team, and they losing access to data/finances.
The best way to think of cryptocurrencies being "too absolutist" (irreversible) is as of a complementary counterpart to the (fiat) money which is too open to interpretation and always subject to unexpected third party decisions.
Even just rendering engines can have bugs that can be exploited by specially crafted content. While it reduces the attack surface, it would be a massive hit to usability of web pages.
On that, PDFs run scripts and use graphic libraries, they are not text documents.
I'll take open and a slight risk vs closed and a slight risk.
I don't need anyone's approval to run native apps either, both my PCs run C apps I built from source and shell scripts I wrote myself without it, languages of my choice with implementations simple enough to write myself, not runtimes that literally no one that's not Google can afford to independently maintain. That's real openness.
Maybe we should have a dozen protocols for different kinds of applications. (I mean user-facing applications!) Maybe online banking shouldn't involve CSS and JavaScript. Spending some time with Gemini is a real eye opener in this respect.
In 20 years on the Internet, most without an ad blocker, I haven't suffered from any lapses in browser security (that I know of, sure, but I don't much care about those I don't know about)
The tale of frequent compromises of browsers via ads is told merely to legitimize the practice of blocking even entirely plain and benign ads.
Nowadays, the first thing I do when "cleaning up" a non-tech friend/relative's computer is to install uBlock Origin. Since I started doing that, the number of repeat calls dropped precipitously. (To be honest, it's probably good for their fake news intake, too...)
The web is a lot scarier for most people than you might realize if you've been successfully navigating away from sketchy sites for 30 years.
You were never clickjacked?
Never had pop-up or pop-under ads/windows created without your consent? Recursively? Crashing your browser?
Never visited a page that was hijacked with an iframe?
I've experienced a lot of malicious ads in my time on the internet, it baffles me that someone has not.
I think the actual malware infections themselves legitimize the practice of blocking even entirely plain and benign ads.
Ads do still infect people with malware. https://blog.confiant.com/tag-barnakle-the-malvertiser-that-... Hell, yahoo was hit not that long ago and users were at risk of infection just by loading yahoo.com.
JS exploits and malware written in JS are common, but so far I haven't seen CSS used to infect systems, just steal data/log keystrokes and add a lot of privacy concerns which is bad enough. I'm already keeping an eye out for a CSS blocker that will only allow a sane subset of CSS and block or limit externally hosted resources.