ISSUE-200

Should an AA security indication include all elements in the evaluation, or just the top document

State:

CLOSED

Product:

wsc-xit

Raised by:

Yngve Pettersen

Opened on:

2008-05-13

Description:

Related to Mixed content http://www.w3.org/2006/WSC/drafts/rec/rewrite.html#securepage

A question related to Augmented Assurance certificates, such as EV, is whether or not an indicator based on such a certificate should be displayed if one or more of the resources (except the main document) used to build the document are not loaded from servers presenting such an AA certificate?

There are several subquestions in this area, for example:

- What does the user expect when he sees the indicator
- How does sensitive parts of the document not having an AA certificate affect the transaction and the epxectations
- What are the legal effects of displaying an AA indicator on a page that contain non-AA content?

See also: http://my.opera.com/yngve/blog/2007/06/19/it-aint-ev-til-its-ev-all-ev

Suggested language:

"A user agent that can display an AA indicator MUST NOT display this indicator unless all elements of the page are loaded from servers presenting an AA certificate."

Related Actions Items:

• ACTION-450 on Anil Saldhana to Update section 5.3 (Mixed Content) to include proposal 2 text - due 2008-05-29, closed

Related emails:

1. wsc-xit issues clean-up (from tlr@w3.org on 2008-08-21)
2. Draft minutes: WSC WG weekly 2008-06-11 (from tlr@w3.org on 2008-06-11)
3. Meeting record: 2008-05-14 (from tlr@w3.org on 2008-06-06)
4. Meeting record: 2008-05-13 (from tlr@w3.org on 2008-06-06)
5. ISSUE-200: Should an AA security indication include all elements in the evaluation, or just the top document [wsc-xit] (from sysbot+tracker@w3.org on 2008-05-13)

Related notes:

Display change log