From Tim Moses
Entrust Inc.
The Web, and the HTML browser through which it is viewed, have had a remarkable impact on productivity in the fields of research, commerce, entertainment, etc.. However, several aspects of the interface can be misleading and susceptible to exploitation by criminals.
Perhaps the most serious problem is that the browser offers no trusted path between the user and the Web application: there is no region of the browser interface in which the user can have complete confidence that the keystrokes she enters are visible only to the intended application and that the information displayed was originated only by the intended application.
The browser has been designed with a strong emphasis on an appealing user experience. And this must have contributed to the remarkable success of the Web. Improved trustworthiness of the interface would surely detract from the appeal. However, consideration should be given to reserving a portion of the browser real-estate for input and output of especially sensitive data that is directly connected to the SSL tunnel. Of course, precautions must be taken to ensure that this area cannot be undetectably overlaid by programs running either inside or outside the browser.
The use of more visual cues, such as trademarks, to identify the end-point of the SSL tunnel will make for a more familiar and comfortable experience for the user. However, research is required into the practical difficulties and limitations of reliance on such visual cues. Certainly, the fidelity of trademarks rendered in micro-browsers may represent a significant limitation.
There may be no viable solution to some of these problems, given the state of the trustworthiness of current platforms. However, given the growing suspiciousness on the part of the consumer community, future productivity gains are in jeopardy if the development community does not use its best efforts to solve them.