Edit comment LC-1916 for Web Security Context Working Group

Quick access to LC-1915 LC-1916

Comment LC-1916

Comment Shortname:

Commenter: Thomas Roessler <tlr@w3.org>

Message-id:

Section of the document concerned:

[Free text description]Document as a wholeWeb Security Experience, Indicators and Trust: Scope and... Web Security Experience, Indicators and Trust: Scope and Use Cases W3C Working Draft 1 November 2007 Abstract Status of this Document Table of Contents 1 Overview 2 Goals 2.1 Document the status quo 2.2 Relevance of security information 2.3 Consistent presentation of security information 2.4 User awareness of security information 2.5 Reliable presentation of security information 2.6 Reduce the number of scenarios in which users need to make trust decisions 2.7 Authoring and deployment techniques 2.8 Best practices for other media 3 Non-goals 3.1 Presentation of all security information 3.2 Non-HTTP Web interactions 4 In scope 4.1 Web interactions 4.2 User agents 4.3 Entity identification 4.4 Third-party recommendation 4.5 Historical browsing information 5 Out of scope 5.1 Protocols 5.2 non-Web interactions 5.3 Security context information for consumption by automated agents 5.4 New security information 5.5 Content based detection 5.6 Security information about the user's computer 5.7 User agent exploits 5.8 User separation 5.9 Content production exploits 5.10 Other security challenges 6 Use cases 6.1 User decisions 6.1.1 Providing sensitive information to a web site 6.1.2 Believing information to come from a known author 6.1.3 Installing software downloaded from a web site 6.2 Navigation 6.2.1 Unidentified destination 6.2.2 Unidentified source 6.3 User agent type 6.3.1 Desktop browser 6.3.2 Smartphone 6.4 Accessibility 6.5 Scenarios any any any any any any any any any any any smartphone Unidentified source, Identified destination any any smartph... any any any any any any any any Identified source, Identified destination, Providing Once a... Identified source, Identified destination, Providing Betty'... Identified source, Unidentified destination, Providing Once... Unidentified source, Identified destination, Providing In t... Unidentified source, Identified destination, Providing Exam... Unidentified source, Identified destination, Providing Whil... Unidentified source, Unidentified destination, Providing Ex... Identified source, Identified destination, Believing Betty... Identified source, Identified destination, Believing Betty... Identified source, Unidentified destination, Believing Bett... Unidentified source, Unidentified destination, Believing Be... Unidentified source, Unidentified destination, Believing Be... Unidentified source, Unidentified destination, Believing Li... Unidentified source, Unidentified destination, Believing Be... Identified source, Identified destination, Installing Once... Identified source, Unidentified destination, Installing Fra... Identified source, Unidentified destination, Installing Vic... Unidentified source, Identified destination, Installing Wat... Unidentified source, Identified destination, Installing Ste... Unidentified source, Unidentified destination, Installing O... Identified source, Identified destination, No interaction B... Unidentified source, Unidentified destination, No interacti... 6.6 Threats 6.6.1 Subverted navigation 6.6.1.1 URL typo 6.6.1.2 Misleading bookmark 6.6.1.3 Misleading introduction 6.6.1.4 Unprotected navigation 6.6.2 Web site impersonation 7 Security information available to the user agent 7.1 Defined by web content specifications presence of client-side dynamic content The rendering of a... 7.2 Defined by SSL related specifications SSL server certificate chain [PKIX] certificate authority... 7.3 Defined by HTTP related specifications HTTP redirect [HTTP] 7.4 Defined by IP related specifications 7.5 Defined by DNS related specifications 7.6 Defined by user agent installed certificate authorities 7.7 State that may be collected by a user agent Has rendering of a page completed? referring page submitted passwords submitted form values user agent customization user response to prompts 7.8 Defined by a third-party 8 Merits of the status quo 8.1 Widely deployed, strong cryptography 8.2 Many deceptive imitation techniques prevented 8.3 Corrected implementation errors 8.4 Password management 9 Problems with the status quo 9.1 Poorly defined area for chrome 9.1.1 Picture in picture 9.1.2 Visually extending the chrome 9.1.3 Removing the chrome 9.2 Poorly defined role for chrome 9.2.1 Browser window title 9.2.2 Back and forward buttons 9.2.3 URL bar 9.2.4 Padlock icon 9.2.5 Favicon 9.2.6 Status bar 9.2.7 Information bar (aka: notification bar) 9.3 Poor user understanding of chrome 9.3.1 Padlock icon 9.3.2 Hostname 9.3.3 Chrome versus page 9.3.4 Explanations versus understanding 9.4 Poor usability of chrome 9.4.1 Out of sight, out of mind 9.4.2 Assumed safety 9.4.3 Poor usability of dialog boxes 10 Process 10.1 Expertise and experience 10.2 Reliance on general usability expertise 10.2.1 Affordance 10.2.2 Conceptual model 10.2.3 Match between system and the real world 10.2.4 Habit formation 10.2.5 Single locus of attention 10.2.6 Aesthetic and minimalist design 10.2.7 Help users recognize, diagnose, and recover from errors 10.2.8 Provide explanations, justifying the advice or information given 10.2.9 Understand the user 10.2.10 Create task profiles 10.2.11 Consistency 10.3 Learning from past efforts 10.3.1 No user categories in phishing vulnerability 10.3.2 The user must be aware of the task they are to perform 10.4 Implementation and testing 11 Acknowledgments 12 References DNSSEC Design of Everyday Things Designing Trust Designing the User Interface EV Cert Favicon HTTP HTTP Auth HTTP Cookie HTTPS Humane Interface Johnny Johnny 2 Make Up Your Mind OCSP PKIX Saltzer and Schroeder Security Toolbars Security and Usability Social Phishing TLS Ten Usability Heuristics Tiny Fingers Users' conceptions W3C Process W3C Testing WCAG WEBARCH WSC-CHARTER WSC-THREATS Why Phishing Works
or

Refinement of the section concerned:

Status:

open proposal pending resolved_yes resolved_no resolved_partial other assigned to Nobody

Type: substantive editorial typo question general comment undefined

Comment:

ignore this comment

Related issues: (space separated ids)

WG Notes:

Resolution:

(Please make sure the resolution is adapted for public consumption)