Edit comment LC-1914 for Web Security Context Working Group

Quick access to LC-1878 LC-1914

Comment LC-1914

Comment Shortname:

Commenter:

Message-id:

Section of the document concerned:

[Free text description]Document as a wholeWeb Security Experience, Indicators and Trust: Scope and... Web Security Experience, Indicators and Trust: Scope and Use Cases W3C Working Draft 25 May 2007 Abstract Status of this Document Table of Contents 1 Overview 2 Goals 2.1 Document the status quo 2.2 Relevance of security information 2.3 Consistent presentation of security information 2.4 User awareness of security information 2.5 Reliable presentation of security information 2.6 Reduce the number of scenarios in which users need to make trust decisions 2.7 Authoring and deployment techniques 2.8 Best practices for other media 3 Non-goals 3.1 Presentation of all security information 3.2 Non-HTTP Web interactions 4 In scope 4.1 Web interactions 4.2 User agents 4.3 Entity identification 4.4 Third-party recommendation 4.5 Historical browsing information 5 Out of scope 5.1 Protocols 5.2 non-Web interactions 5.3 Security context information for consumption by automated agents 5.4 New security information 5.5 Content based detection 5.6 Security information about the user's computer 5.7 User agent exploits 5.8 User separation 5.9 Content production exploits 6 Use cases 6.1 Destination site 6.2 User's navigation toward the destination site 6.3 Intended interaction 6.4 Actual interaction 6.5 Scenarios 7 Security information available to the user agent 7.1 Provided by HTTP Has the page completed loading? referring page redirection path content-type 7.2 Provided by web content presence of client-side dynamic content The rendering of a... 7.3 Provided by SSL SSL server certificate chain [PKIX] certificate authority... CRL [PKIX] 7.4 Provided by IP or DNS 7.5 Provided by user agent installed certificate authorities Has the user agent completed rendering of the page? 7.6 Provided by user submitted passwords submitted form values user's understanding of his task user agent customization 7.7 Provided by third-party 8 Merits of the status quo 8.1 Widely deployed, strong cryptography 8.2 Many deceptive imitation techniques prevented 8.3 Corrected implementation errors 8.4 Password management 9 Problems with the status quo 9.1 Poorly defined area for chrome 9.1.1 Picture in picture 9.1.2 Visually extending the chrome 9.1.3 Removing the chrome 9.2 Poorly defined role for chrome 9.2.1 Browser window title 9.2.2 Back and forward buttons 9.2.3 URL bar 9.2.4 Padlock icon 9.2.5 Favicon 9.2.6 Status bar 9.2.7 Information bar (aka: notification bar) 9.3 Poor user understanding of chrome 9.3.1 Padlock icon 9.3.2 Hostname 9.3.3 Chrome versus page 9.3.4 Explanations versus understanding 9.4 Poor usability of chrome 9.4.1 Out of sight, out of mind 9.4.2 Assumed safety 9.4.3 Poor usability of dialog boxes 10 Process 10.1 Expertise and experience 10.2 Reliance on general usability expertise 10.2.1 Affordance 10.2.2 Conceptual model 10.2.3 Match between system and the real world 10.2.4 Habit formation 10.2.5 Single locus of attention 10.2.6 Aesthetic and minimalist design 10.2.7 Help users recognize, diagnose, and recover from errors 10.2.8 Provide explanations, justifying the advice or information given 10.2.9 Understand the user 10.2.10 Create task profiles 10.2.11 Consistency 10.3 Learning from past efforts 10.3.1 No user categories in phishing vulnerability 10.3.2 The user must be aware of the task they are to perform 10.4 Implementation and testing 11 Acknowledgments 12 References Why Phishing Works Security Toolbars Users' conceptions Security and Usability Humane Interface Designing the User Interface Ten Usability Heuristics Design of Everyday Things Johnny HTTP Auth HTTP Cookie PKIX HTTPS TLS EV Cert OCSP DNSSEC favicon W3C Process W3C Testing Johnny 2 Social Phishing Make Up Your Mind Designing Trust web-arch Tiny Fingers WAI-WEBCONTENT
or

Refinement of the section concerned:

Status:

open proposal pending resolved_yes resolved_no resolved_partial other assigned to Nobody

Type: substantive editorial typo question general comment undefined

Comment:

test message

Related issues: (space separated ids)

WG Notes: From public comments raised by: Al Gilman Alfred.S.Gilman@ieee.org http://lists.w3.org/Archives/Public/public-usable- authentication/2007Apr/0000.html full legal entity identification (is a must) where it says, in 4.3 Entity Identification designators that helps the user recognize which entity they are currently conversing with please consider If the user can\'t readily drill down and get a fully-qualified answer to \"who do I sue?\" you are wasting your breath. The fact that the user could, in principle, start an independent, un-prompted browse through WhoIs does not meet this requirement. Why? Business runs on recourse. The best commercial practice is not to get it right; but to refund on dissatisfaction. You can\'t rewrite this aspect of the climate of values that bear on the small domain of transactions you are working on.

Resolution: please consider Model and prioritize the full security infoset and actions. Recommend good practice as to what to engage the user with and when predicated on articulated assumptions of a default delivery context. The Screen Reader (for example) and not the Working Group has enough knowledge of the user experience and habits to make appropriate presentation-pruning and presentation-effect-binding decisions

(Please make sure the resolution is adapted for public consumption)