This repository was archived by the owner on Nov 4, 2024. It is now read-only.
This repository was archived by the owner on Nov 4, 2024. It is now read-only.
Absence of scripts or cookies should not be worth fewer points than secure cookies/scripts #449
Description
Currently, the HTTP Observatory grants an extra 5 points for secure cookies and 5 for scripts with SRI; it grants +0 if a site has no cookies and +0 for sites without any scripts.
Secure cookies and scripts aren't as secure as an absence of cookies and scripts, so it doesn't make sense to give sites with these features a higher score than cookieless/scriptless sites. Rewarding cookieless/scriptless sites at least as much could help push the idea that cookies and scripts shouldn't be used unnecessarily.