W3C home > Mailing lists > Public > ietf-http-wg@w3.org > October to December 2013

Re: What will incentivize deployment of explicit proxies?

From: Yoav Nir <synp71@live.com>
Date: Tue, 3 Dec 2013 23:28:25 +0200
Message-ID: <BLU0-SMTP3096A4033AFA4B1B1ACEFF3B1D50@phx.gbl>
To: Nicolas Mailhot <nicolas.mailhot@laposte.net>, "William Chan (陈智昌)" <willchan@chromium.org>
CC: Roberto Peon <grmocg@gmail.com>, HTTP Working Group <ietf-http-wg@w3.org>
On 3/12/13 10:00 PM, Nicolas Mailhot wrote:
> Le Mar 3 décembre 2013 19:53, William Chan (陈智昌) a écrit :
>
>>> On 3/12/13 3:16 PM, Nicolas Mailhot wrote:
>>>
>>>> Le Mar 3 décembre 2013 12:24, Yoav Nir a écrit :
>>>>
>>>>
>>>> 5. Prompt the user:
>>>>
>>>> Accept using gateway-name to access http://awebsite.com/ and other web
>>>> sites in ingoing-http2-mode ?
>>>>
>>>> [check reformatted access rules] [see help page] [see certificate]
>>>>
>>>>     [ ] Prompt for other web sites and security modes
>>>>     ( ) only for this session ( ) all the time
>>>>     (*) only from here        ( ) everywhere
>>>>                                            [Yes] [No]
>> <pushback>
>> I can probably expect to be tarred and feathered by my security team if I
>> tell them we need to put up a UI asking the end user to make a decision
>> about security :)
>> </pushback>
> Then simplify the prompt to
>
> Access to http://awebsite.com/ requires using gateway-name on this network.
> gateway-name may read some of your traffic. Do you want to proceed ?
>    <link to advanced info>
>    <yes> <no>

Simplification doesn't help. The user is in the middle of doing 
something, and they're not going to take their mind off the task at hand 
to answer your questions.
>
> The only decision the user needs to make is if he's in a location where
> gateway-name is expecter and if he accepts exposing his traffic.

Not everyone has expectations regarding the presence or absence of 
proxies. Only a few would be able to make a good guess as to why the 
proxy is even there (scan for malware? Cache? scan for subversives?)

> That will
> usually be a no-brainer (ok if at hotel, corp, school, nok at home unless
> the proxy is user-deployed).

Guess it's not a no-brainer, because I would not be OK with a decrypting 
proxy at a hotel, coffee shop, or airport.

> And you only need to remind him the gateway
> is in use next time it's encountered via a transient message, in case it
> occurs in an unexpected place, the user wants to rescind the permission or
> he's in private browsing mode. (display gateway name and encryption
> status)

"Your traffic to mail.google.com is being decrypted by 
sslproxy.example.com". Good, bad, or indifferent?





Received on Tuesday, 3 December 2013 21:28:56 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 1 March 2016 11:11:20 UTC