Re: What will incentivize deployment of explicit proxies?

On 3/12/13 10:00 PM, Nicolas Mailhot wrote:
> Le Mar 3 décembre 2013 19:53, William Chan (陈智昌) a écrit :
>
>>> On 3/12/13 3:16 PM, Nicolas Mailhot wrote:
>>>
>>>> Le Mar 3 décembre 2013 12:24, Yoav Nir a écrit :
>>>>
>>>>
>>>> 5. Prompt the user:
>>>>
>>>> Accept using gateway-name to access http://awebsite.com/ and other web
>>>> sites in ingoing-http2-mode ?
>>>>
>>>> [check reformatted access rules] [see help page] [see certificate]
>>>>
>>>>     [ ] Prompt for other web sites and security modes
>>>>     ( ) only for this session ( ) all the time
>>>>     (*) only from here        ( ) everywhere
>>>>                                            [Yes] [No]
>> <pushback>
>> I can probably expect to be tarred and feathered by my security team if I
>> tell them we need to put up a UI asking the end user to make a decision
>> about security :)
>> </pushback>
> Then simplify the prompt to
>
> Access to http://awebsite.com/ requires using gateway-name on this network.
> gateway-name may read some of your traffic. Do you want to proceed ?
>    <link to advanced info>
>    <yes> <no>

Simplification doesn't help. The user is in the middle of doing 
something, and they're not going to take their mind off the task at hand 
to answer your questions.
>
> The only decision the user needs to make is if he's in a location where
> gateway-name is expecter and if he accepts exposing his traffic.

Not everyone has expectations regarding the presence or absence of 
proxies. Only a few would be able to make a good guess as to why the 
proxy is even there (scan for malware? Cache? scan for subversives?)

> That will
> usually be a no-brainer (ok if at hotel, corp, school, nok at home unless
> the proxy is user-deployed).

Guess it's not a no-brainer, because I would not be OK with a decrypting 
proxy at a hotel, coffee shop, or airport.

> And you only need to remind him the gateway
> is in use next time it's encountered via a transient message, in case it
> occurs in an unexpected place, the user wants to rescind the permission or
> he's in private browsing mode. (display gateway name and encryption
> status)

"Your traffic to mail.google.com is being decrypted by 
sslproxy.example.com". Good, bad, or indifferent?