ACTION-282

Email from Serge:

=======================
It is unlikely that users will examine secondary chrome or take other
proactive steps in order to examine contextual information. Studies
have shown that few users examine primary chrome (which requires no
additional actions) for security information. In one study on SSL
indicators, no users examined contextual information in primary chrome
when not primed for security. Though when primed for security in the
laboratory, around 70% started to notice the lock icon [1]. In another
study where participants were primed for security, roughly half of them
used secondary chrome to examine SSL certificates [2]. Thus, it likely
that when not primed for security (outside the laboratory setting) even
fewer users will bother to take overt actions to examine contextual
information in secondary chrome.

1. T. Whalen and K. M. Inkpen. Gathering Evidence: Use of Visual
Security Cues in Web Browsers. In Proceedings of the 2005 Conference on
Graphics Interface, pages 137–144, Victoria, British Columbia, 2005.

2. H. Xia and J. C. Brustoloni. Hardening web browsers against
man-in-the-middle and eavesdropping attacks. In Proceedings of the 14th
International World Wide Web Conference (WWW2005), pages 489–497.
W3C/ACM, May 2005. http://www.cs.pitt.edu/ jcb/papers/www2005.pdf.