Edit comment LC-2256 for Web Security Context Working Group

Quick access to LC-2199 LC-2255 LC-2256 LC-2257

Comment LC-2256

Comment Shortname:

Commenter: Anne van Kesteren <annevk@opera.com>

Message-id:

Section of the document concerned:

[Free text description]Document as a wholeWeb Security Context: User Interface Guidelines... Web Security Context: User Interface Guidelines W3C Working Draft 26 February 2009 Abstract Status of this Document Table of Contents 1 Overview 2 Acknowledgments 3 Conformance 3.1 Product classes Definition 3.2 Language conventions 3.3 Conformance levels Definition Definition 3.4 Conformance claims 4 Interaction and content model 4.1 Overview 4.2 Terms and definitions Definition Definition 4.2.1 Common User Interface elements Definition Definition Definition 5 Applying TLS to the Web 5.1 Certificate Handling and Information 5.1.1 Interactively accepting trust anchors or certificates Definition 5.1.2 Augmented Assurance Certificates Definition Definition 5.1.3 Validated Certificates Definition 5.1.4 Self-signed Certificates and Untrusted Root Certificates Definition 5.2 Types of TLS Definition Definition Definition Definition Definition 5.3 Mixed Content Definition Definition 5.4 Error conditions 5.4.1 TLS errors 5.4.2 Error Conditions based on Third Party or Heuristic Information 5.4.3 Redirection chains 5.4.4 Insecure form submission 6 Indicators and Interactions 6.1 Identity and Trust Anchor Signaling 6.1.1 Identity Signal Definition 6.1.2 Identity Signal Content 6.2 Additional Security Context Information The information sources MUST make the following security con... the Web page's domain name Owner information, consistent with 6.1.2 Identity Signal Con... Verifier information, consistent with 6.1.2 Identity Signal... The reason why the identity information is trusted (or not).... The information sources SHOULD make the following security c... What protection level is represented by the TLS indicator; Whether the user has visited the site in the past. Whether the user has stored credentials for this site. Whether the site content was encrypted in transmission. Whether the site content was authenticated (e.g., server aut... Additionally, the information sources MAY make the following... When the user most recently visited the site in the past. When the user first visited the site in the past. How often the user visited the site in the past. 6.3 TLS indicator Definition 6.4 Error handling and signaling 6.4.1 Common Error Interaction Requirements 6.4.2 Warning/Caution Messages 6.4.3 Danger Messages 7 Robustness Best Practices 7.1 Keep Security Chrome Visible 7.2 Do not mix content and security indicators 7.3 Managing User Attention Definition User interfaces used to inform users about security critical... 7.4 APIs Exposed To Web Content 7.4.1 Obscuring or disabling Security User Interfaces Web user agents MUST prevent web content from obscuring, hid... Web user agents MUST restrict window sizing and moving opera... Web user agents MUST NOT allow web content to open new windo... Web user agents MUST prevent web content from overlaying chr... 7.4.2 Software Installation Web user agents MUST NOT expose programming interfaces which... Web user agents MUST inform the user and request consent whe... 7.4.3 Bookmarking APIs Web user agents MUST NOT expose programmatic interfaces that... Web user agents MUST NOT expose programmatic interfaces that... 7.4.4 Pop-up Window APIs With visual user interfaces that use a windowed interaction... Web user agents which offer this restriction SHOULD offer a... 8 Security Considerations 8.1 Active attacks during initial TLS interactions 8.2 Certificate Status Checking Failures 8.3 Certificates assure identity, not security 8.4 Binding "human readable" names to domain names 8.5 Warning Fatigue 8.6 Mixing Augmented Assurance and Validated Certificates 9 References ECRYPT2006 EFFECTIVE EMPEROR EVTLSCERT FAVICON KCM NESSIE PETNAMES PKIX RFC2119 RFC2560 RFC2616 RFC2817 RFC2818 RFC2965 RFC3281 RFC3709 RFC3986 RFC4254 RSA-SIZES SSLv3 TLSv11 TLSv12 WCAG20 WHALENEVIDENCE WSC-THREATS WSC-USECASES XIA
or

Refinement of the section concerned:

Status:

open proposal pending resolved_yes resolved_no resolved_partial other assigned to Nobody

Type: substantive editorial typo question general comment undefined

Resolution status:

Response drafted Resolution implemented Reply sent to commenter

Response status:

No response from Commenter yet Commenter approved disposition Commenter objected to disposition
Commenter's response (URI):

Comment:

"user agent" -- The draft uses the term "user agent" for conformance
levels and uses the term "web user agent" elsewhere. For the kind of
requirements the draft makes most other specifications simply use "user
agent". It would be nice if the draft could align with that. In case the
deviation is found necessary for some reason it should be consistently
used. In section 7.4 the term "browser" is also sometimes used. Is that
intentional?

"web page" -- The definition of Web page seems to include that it cannot
be embedded so I wonder what "top-level Web page" in section 4 means. If
this document is indeed aimed at browser vendors (and it sure seems like
it) it might be good to align terminology with HTML5. For what you want
here the term "top-level browsing context" would be appropriate. Unlike
"web page" that term is also defined in a lot more detail so that there
can be no doubt as to what is meant.

"must not" -- the last paragraph of 7.4.1 has a lowercase must not. I
assume this is supposed to be uppercase.

"chrome" -- technically scrollbars and such are also part of this, but
should probably be excluded for most purposes here since positioning
something over an element with a scrollbar is fine.

I also wonder the excessive use of MUST is warranted given that a lot of
these things are user interface constraints that might not be applicable
everywhere.

Related issues: (space separated ids)

WG Notes:

Resolution: Thank you for your review. We consistently use "user agent" now. We're staying with the "web page" definition we have, since it's what we all understand. actually the "must not" in the last paragraph of 7.4.1. was not conformance language; it has been reworked. "Chrome" refers to both primary and secondary UI; we've attempted to make the clearer. We've reviewed the MUSTs (and all the recommendations) carefully and think they're sane. Want to change any in particular, and if so, why?

(Please make sure the resolution is adapted for public consumption)