- From: Serge Egelman <egelman@cs.cmu.edu>
- Date: Thu, 10 Jan 2008 15:56:05 -0500
- To: Anil Saldhana <Anil.Saldhana@redhat.com>
- CC: "public-wsc-wg@w3.org" <public-wsc-wg@w3.org>
Anil Saldhana wrote: > > To reiterate what Ian said yesterday, usability studies are necessary > but not sufficient. Exactly, which means that usability studies should be done as the absolute minimum. >Just because 25% do not see the indicators does not > mean, we should not work towards them. :) Of course not, I'm not sure if anyone is advocating that. My point was that we should not emulate the current indicators which we already know have failed. We should use that knowledge to make something better. More simply: if we do it this way, we know that in the absolute best case, 25% of the users will not notice them. Thus, we should find a better way. > > Personally, when I face PII situation on the web, I look for two things > (https and the padlock). Again going by what Ian said yesterday, there > is little chance that my information will be compromised during transit > at that particular time. So these two indicators (even though padlock is > a side-effect of the other), are sufficient for me in addition to the > credibility of the website that I am entering the information into. Yes, and you're not the user we should be focusing on. You're an engineer at a software company. You represent a very small fraction of a very small fraction of the users out there. What comes out of this working group could probably completely ignore you, since you're probably doing everything properly as it is. > > Serge Egelman wrote: >> Yes, this shouldn't be the gauge for any decision, since all the >> studies which have been performed have shown the opposite. Even when >> explicitly told to look for security information in laboratory >> settings, 25% usually don't. >> >> serge >> >> William Eburn wrote: >>> Hello all, >>> >>> As related to the padlock, everyone I know (which shouldn't be the gauge >>> for any decision) knows what the padlock means. This is probably (and >>> this is a guess) due to the number of years that it's been out there. >>> So, with this in mind I just walked around my company and I asked if >>> everyone knew what the big show was in Vegas this week. One person >>> knew. I used this example because CES is being advertised worldwide in >>> every venue. So everyone isn't aware of it when it is happening. To >>> get rid of the padlock in its entirety, you would run for a period of >>> time where people didn't know there was a change. You would also be >>> wasting, lots of years of education. So I would vote that we keep the >>> padlock, there is nothing wrong with augmenting it (As long as it's not >>> some security score). >>> >>> Bill >>> >>> >>> -----Original Message----- >>> From: public-wsc-wg-request@w3.org [mailto:public-wsc-wg-request@w3.org] >>> On Behalf Of Serge Egelman >>> Sent: Thursday, January 10, 2008 2:55 PM >>> To: Anil Saldhana >>> Cc: michael.mccormick@wellsfargo.com; ifette@google.com; >>> hahnt@us.ibm.com; public-wsc-wg@w3.org >>> Subject: Re: Is the padlock a page security score? >>> >>> >>> No, what I'm saying is that any passive indicator for this purpose >>> will have the same fate as the SSL padlock: 99% of users will not >>> notice it, distrust it, or misunderstand it. That 1% who does look >>> for it will generally be savvy users who are in a lower risk group to >>> begin with. >>> >>> This isn't necessarily a bad thing, my point is that this indicator >>> is not something for the masses. >>> >>> I would opt for recommending this icon to replace the SSL indicator. >>> It'll be useful for the savvy users. And when it hits a certain risk >>> threshold, use that data to throw up a full-screen warning, which >>> will be useful to the other 99%. Of course, these warnings should >>> only appear when there really is certain danger, otherwise users get >>> habituated and begin ignoring them in the future. >>> >>> >>> serge >>> >>> Anil Saldhana wrote: >>>> Serge, what you say makes perfect sense from usability >>> perspective(also >>>> drawing inspiration from the recent discussion on pop-up dialog >>>> boxes between Ian and me) - people will tend to ignore when there >>>> are indicators that consistently show their favorite sites to have low >>> scores. >>>> But does that mean that we should not recommend additional indicators? >>>> >>>> I do not agree on the throwing up of danger warnings once in a while >>>> without an associated (passive) indicator. At least the user will have >>> >>>> an opportunity to figure out the danger warning emanated from this >>>> indicator that was dormant but has suddenly woken up to throw this >>> warning. >>>> Serge Egelman wrote: >>>>> In that case the best scenario for a website is that it gets a medium >>> >>>>> setting? I can tell you right now that's a nonstarter. Based on >>>>> empirical evidence we know that users will become habituated and stop >>> >>>>> paying attention to the indicator when it constantly tells them >>>>> that websites they frequent "might not be trustworthy." >>>>> >>>>> From a practical standpoint, if the scores range from "danger" to >>>>> "unknown," why show the passive indicator at all? Instead, when it >>>>> hits "danger," throw up a warning. This is far more effective in >>>>> practice. >>>>> >>>>> serge >>>>> >>>>> michael.mccormick@wellsfargo.com wrote: >>>>>> If you feel the available variables only give half the security >>>>>> picture, I suppose your UA could define a scoring algorithm that >>>>>> never returns a value higher than 50. >>>>>> >>>>>> >>> ------------------------------------------------------------------------ >>>>>> *From:* Ian Fette [mailto:ifette@google.com] >>>>>> *Sent:* Thursday, January 10, 2008 1:09 PM >>>>>> *To:* McCormick, Mike >>>>>> *Cc:* hahnt@us.ibm.com; public-wsc-wg@w3.org >>>>>> *Subject:* Re: Is the padlock a page security score? >>>>>> >>>>>> I don't know about useless, but I worry a *lot* about giving a false >>> >>>>>> sense of security. There could be a site using DNSSEC and an >>> EV-cert, >>>>>> that is hosted on some crappy shared server that uses a MySQL 3 >>>>>> database and we would give it a 100. That's disturbing to me because >>> >>>>>> it would be very misleading and provide a very false sense of >>> security. >>>>>> On Jan 10, 2008 11:04 AM, <michael.mccormick@wellsfargo.com >>>>>> <mailto:michael.mccormick@wellsfargo.com>> wrote: >>>>>> >>>>>> I agree. I like the weather analogy. There's no perfect >>> security >>>>>> indicator. But the more variables an indicator takes into >>> account >>>>>> the more it approaches the asymptote. >>>>>> I guess the alternative would be to throw up our hands >>>>>> and say all >>>>>> security context indicators are useless. >>>>>> >>>>>> >>> ------------------------------------------------------------------------ >>>>>> *From:* public-wsc-wg-request@w3.org >>>>>> <mailto:public-wsc-wg-request@w3.org> >>>>>> [mailto:public-wsc-wg-request@w3.org >>>>>> <mailto:public-wsc-wg-request@w3.org>] *On Behalf Of *Timothy >>> Hahn >>>>>> *Sent:* Thursday, January 10, 2008 12:54 PM >>>>>> >>>>>> *To:* public-wsc-wg@w3.org <mailto:public-wsc-wg@w3.org> >>>>>> *Subject:* RE: Is the padlock a page security score? >>>>>> >>>>>> >>>>>> Hi all, >>>>>> >>>>>> This whole discussion is subjective. What is useful for one >>> person >>>>>> could very well be useless to someone else. >>>>>> >>>>>> An analogy - weather forecasts about the possibility of rain >>> today. >>>>>> Does such a score indicate whether I will get rained on? No. >>> Does >>>>>> it help me decide whether or not to wear a hat or carry an >>> umbrella? >>>>>> Yes. There is no way that people other than meteorologists >>> (and >>>>>> some would argue, even them) will accurately interpret isobars, >>>>>> cloud patterns, and doppler radar to determine whether it will >>> rain. >>>>>> But people can get a feeling for the chances of rain based on a >>>>>> 0-100% estimate. >>>>>> >>>>>> I think the same is true for the notion of a page security >>> score. >>>>>> Does it imply that the user will definitely, without a doubt, >>> not >>>>>> get "taken"? No. Does it give the user something with which to >>>>>> make a choice? Yes. In this light, I still feel that page >>> security >>>>>> scores are good things to consider. >>>>>> >>>>>> Regards, >>>>>> Tim Hahn >>>>>> IBM Distinguished Engineer >>>>>> >>>>>> Internet: hahnt@us.ibm.com <mailto:hahnt@us.ibm.com> >>>>>> Internal: Timothy Hahn/Durham/IBM@IBMUS >>>>>> phone: 919.224.1565 tie-line: 8/687.1565 >>>>>> fax: 919.224.2530 >>>>>> >>>>>> >>>>>> >>>>>> From: <michael.mccormick@wellsfargo.com >>>>>> <mailto:michael.mccormick@wellsfargo.com>> >>>>>> To: <ifette@google.com <mailto:ifette@google.com>>, >>>>>> <Anil.Saldhana@redhat.com <mailto:Anil.Saldhana@redhat.com>> >>>>>> Cc: Timothy Hahn/Durham/IBM@IBMUS, <public-wsc-wg@w3.org >>>>>> <mailto:public-wsc-wg@w3.org>>, >>> <Mary_Ellen_Zurko@notesdev.ibm.com >>>>>> <mailto:Mary_Ellen_Zurko@notesdev.ibm.com>> >>>>>> Date: 01/10/2008 01:34 PM >>>>>> Subject: RE: Is the padlock a page security score? >>>>>> >>>>>> >>>>>> >>> ------------------------------------------------------------------------ >>>>>> >>>>>> >>>>>> I would ask the same question about a binary indicator. The >>> padlock >>>>>> does not mean it's safe to enter a credit card. >>>>>> >>>>>> >>> ------------------------------------------------------------------------ >>>>>> *From:* Ian Fette [mailto:ifette@google.com] * >>>>>> Sent:* Thursday, January 10, 2008 12:26 PM* >>>>>> To:* Anil Saldhana* >>>>>> Cc:* McCormick, Mike; hahnt@us.ibm.com >>> <mailto:hahnt@us.ibm.com>; >>>>>> public-wsc-wg@w3.org <mailto:public-wsc-wg@w3.org>; >>>>>> Mary_Ellen_Zurko@notesdev.ibm.com >>>>>> <mailto:Mary_Ellen_Zurko@notesdev.ibm.com>* >>>>>> Subject:* Re: Is the padlock a page security score? >>>>>> >>>>>> I still don't understand what anything beyond a binary result is >>>>>> supposed to tell a user. I'm on a site with "Medium" security - >>> what >>>>>> does that mean? Does that mean that I should give them my credit >>>>>> card or not? >>>>>> >>>>>> On Jan 10, 2008 10:00 AM, Anil Saldhana >>> <_Anil.Saldhana@redhat.com_ >>>>>> <mailto:Anil.Saldhana@redhat.com>> wrote: >>>>>> >>>>>> Maybe there is an opportunity to associate "High/Medium/Low" or >>>>>> "Strong/Medium/Low" based on page security score with the >>> padlock. >>>>>> _ >>>>>> __michael.mccormick@wellsfargo.com_ >>>>>> <mailto:michael.mccormick@wellsfargo.com> wrote: >>>>>> > Sure, I agree the padlock is a binary representation of a >>> boolean >>>>>> security >>>>>> > score formula based on a single security variable (SSL on >>> main >>>>>> page). A >>>>>> > degenerate case IMHO - but still technically a page >>>>>> security score. >>>>>> > >>>>>> > A security score algorithm should take into account most (if >>> not >>>>>> all) of the >>>>>> > variables we enumerated under "What is a Secure Page?" >>> Perhaps >>>>>> the note >>>>>> > should state that explicitly. Then padlocks wouldn't >>> qualify. >>>>>> > >>>>>> > _____ >>>>>> > >>>>>> > From: _public-wsc-wg-request@w3.org_ >>>>>> <mailto:public-wsc-wg-request@w3.org> >>>>>> [mailto:_public-wsc-wg-request@w3.org_ >>>>>> <mailto:public-wsc-wg-request@w3.org>] On >>>>>> > Behalf Of Timothy Hahn >>>>>> > Sent: Thursday, January 10, 2008 10:40 AM >>>>>> > To: _public-wsc-wg@w3.org_ <mailto:public-wsc-wg@w3.org> >>>>>> > Subject: Re: Is the padlock a page security score? >>>>>> > >>>>>> > >>>>>> > >>>>>> > Mez, >>>>>> > >>>>>> > I'll toss in my view that the padlock is an example of a page >>>>>> security >>>>>> > score. In most user agents, this seems to be pretty much >>>>>> "binary" (on or >>>>>> > off) though I think we've heard from some folks that there >>> are >>>>>> some >>>>>> > "embellishments" on their display of the icon which would >>> provide >>>>>> more >>>>>> > gradations based on information received. >>>>>> > >>>>>> > On the bright side of such a visible item - it is >>>>>> relatively easy to >>>>>> > describe and for people to grasp the meaning of. >>>>>> > >>>>>> > On the down side of the padlock - ... well, we've had lots >>> of >>>>>> that >>>>>> > discussion on this list already - see the archives. >>>>>> > >>>>>> > Regards, >>>>>> > Tim Hahn >>>>>> > IBM Distinguished Engineer >>>>>> > >>>>>> > Internet: _hahnt@us.ibm.com_ <mailto:hahnt@us.ibm.com> >>>>>> > Internal: Timothy Hahn/Durham/IBM@IBMUS >>>>>> > phone: 919.224.1565 tie-line: 8/687.1565 >>>>>> > fax: 919.224.2530 >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > From: "Mary Ellen Zurko" >>>>>> <_Mary_Ellen_Zurko@notesdev.ibm.com_ >>>>>> <mailto:Mary_Ellen_Zurko@notesdev.ibm.com>> >>>>>> > >>>>>> > To: _public-wsc-wg@w3.org_ <mailto:public-wsc-wg@w3.org> >>>>>> > >>>>>> > Date: 01/10/2008 11:10 AM >>>>>> > >>>>>> > Subject: Is the padlock a page security score? >>>>>> > >>>>>> > _____ >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > If not, why not? >>>>>> > >>>>>> > Mez >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> >>>>>> -- >>>>>> Anil Saldhana >>>>>> Project/Technical Lead, >>>>>> JBoss Security & Identity Management >>>>>> JBoss, A division of Red Hat Inc._ >>>>>> __http://labs.jboss.com/portal/jbosssecurity/_ >>>>>> >>>>>> >>>>>> >>>>>> >>> >> > -- /* PhD Candidate Carnegie Mellon University "Whoever said there's no such thing as a free lunch was never a grad student." All views contained in this message, either expressed or implied, are the views of my employer, and not my own. */
Received on Thursday, 10 January 2008 20:56:56 UTC