Congratulations on the release of your new browser platform!
I am currently working independently on an open source, non-proprietary infrastructure called the Mathematical Mesh that makes computers easier to use by making them more secure. My question for the development team is what are the security challenges you see in the Web that you would like to see addressed.
Recognizing that such a proposition might require a certain credentials, let me introduce myself: I am Phillip Hallam-Baker, a member of the CERN team that originally developed HTTP and the Web. Since then I spent 20 years as Principal Scientist at VeriSign and then Comodo. I have worked with many members of the Microsoft security team over the years, including the joint work we performed on WS-Security.
The reason for approaching your team directly is that for the past five years I have been looking at ways in which we could move the field past the limited repertoire of cryptographic primitives established by PEM, OpenPGP and S/MIME. I have recently begun proposing this work in IETF. While I will be meeting with Microsoft employees at the Montreal IETF, that does not happen until July and that is at the start of summer break, worst possible time to build momentum. Another consideration is that while I want to hand over development of the Mesh to an open standards body, the IETF may not be the best forum to choose. In the past I have worked in W3C and OASIS and other forums. If I approach the stakeholders through IETF however, we might end up path dependent.
One MESH technology is a means of using a domain name and an encryption key to form a URI that may be converted to a URL by means of a one way function. In layman's terms: Scan this QR code and the browser can retrieve an encrypted resource that it can then decrypt with the information in the URI.
So you could scan a QR code on an invoice and receive a machine readable copy for your bill pay system. But the system is entirely secure end-to-end. All the data stored in the cloud is encrypted. Which means you can meet HIPPA, GDPR requirements, etc.
Right now, I am implementing a demo of this code in a proxy. But it would be a lot more useful in the browser.
Another Mesh technology that might be more relevant to your short term needs is the ability to mange passwords and share them between devices with true end to end security. There is a cryptographic technique known as proxy re-encryption developed by Mat Blaze in the '90 and another technique called split key generation by Torben Pedersen developed around the same time (both out of patent AKAIK). It isn't in the PEM canon but it is well known in the cryptography world. This allows a cloud service to serve up the passwords to all the connected devices without having decryption capability itself. What the cloud service can do however is prevent a device decrypting the passwords. Which allows it to block access if a device is lost or stolen.
If you want to run this past your crypto group, please email me and I can provide references within Microsoft.
So why would Microsoft want to manage passwords this way? Well, Chrome was developed by Google which has a certain approach to liability and the Microsoft I have worked with for almost 30 years has a very different approach. Specifically, storing user's passwords in any form, even encrypted represents a 'steaming pile of liability' as a Microsofter once put it, unless the party storing the passwords can prove that they had absolutely no means of decrypting them.
Another reason for Microsoft to take this approach is that as things stand, Edge is the new contender, you will need to persuade people to switch. When Chrome first appeared on the market, the value proposition it offered was greater security running active content in separate processes. End-to-end secure password management using an open standard that has been widely reviewed in an open standards process is a value proposition that you can explain to a journalist and a journalist can explain to users.
Of course, the real goal is to get rid of the passwords altogether and the same techniques used to distribute the decryption keys to a user's devices can be used for authentication keys as well.
