W3C home > Mailing lists > Public > ietf-http-wg@w3.org > October to December 2013

Re: What will incentivize deployment of explicit proxies?

From: Nicolas Mailhot <nicolas.mailhot@laposte.net>
Date: Tue, 3 Dec 2013 21:00:57 +0100
Message-ID: <e9c8bfa6e2014fd0eb2b01790111f55d.squirrel@arekh.dyndns.org>
To: "William Chan (陈智昌)" <willchan@chromium.org>
Cc: "Yoav Nir" <synp71@live.com>, "Nicolas Mailhot" <nicolas.mailhot@laposte.net>, "Roberto Peon" <grmocg@gmail.com>, "HTTP Working Group" <ietf-http-wg@w3.org>

Le Mar 3 décembre 2013 19:53, William Chan (陈智昌) a écrit :

>> On 3/12/13 3:16 PM, Nicolas Mailhot wrote:
>>
>>> Le Mar 3 décembre 2013 12:24, Yoav Nir a écrit :
>>>
>>>
>>> 5. Prompt the user:
>>>
>>> Accept using gateway-name to access http://awebsite.com/ and other web
>>> sites in ingoing-http2-mode ?
>>>
>>> [check reformatted access rules] [see help page] [see certificate]
>>>
>>>    [ ] Prompt for other web sites and security modes
>>>    ( ) only for this session ( ) all the time
>>>    (*) only from here        ( ) everywhere
>>>                                           [Yes] [No]

> <pushback>
> I can probably expect to be tarred and feathered by my security team if I
> tell them we need to put up a UI asking the end user to make a decision
> about security :)
> </pushback>

Then simplify the prompt to

Access to http://awebsite.com/ requires using gateway-name on this network.
gateway-name may read some of your traffic. Do you want to proceed ?
  <link to advanced info>
  <yes> <no>

The only decision the user needs to make is if he's in a location where
gateway-name is expecter and if he accepts exposing his traffic. That will
usually be a no-brainer (ok if at hotel, corp, school, nok at home unless
the proxy is user-deployed). And you only need to remind him the gateway
is in use next time it's encountered via a transient message, in case it
occurs in an unexpected place, the user wants to rescind the permission or
he's in private browsing mode. (display gateway name and encryption
status)

You don't need to force the user to check the whole access policy and
terms of use, it's only important they are available in the UI so a small
proportion of whistle-blowers can check them and keep the operator honest.

That's how all the small print contracts work in real life, actually. No
one wants to read them and few people do, but if they were not publicly
available all kinds of abuses would be possible.

-- 
Nicolas Mailhot
Received on Tuesday, 3 December 2013 20:01:34 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 1 March 2016 11:11:20 UTC