Re: IAB Statement on Internet Confidentiality

On Wed, Nov 19, 2014 at 08:24:37PM -0800, Tim Bray wrote:
> On Wed, Nov 19, 2014 at 8:13 PM, Greg Wilkins <gregw@intalio.com> wrote:
> 
> You???re mostly right, but here???s where you???re wrong:
> 
> > ??????
> > ??????
> >  Encrypting  is not going to help with any of these problems
> > ???
> >
> 
> ???Yes, it will *help*. No, it will not ???*solve* them, and solving them is
> important, but providing help now is a good thing to do.

No it will not help. It confuses users, and the *only* way to help is
to make it very clear to them whether they're safe or not. It's not by
saying "it's almost safe" that you'll help them. People using public
WiFi at cafes believe they're surfing without anyone knowing what they're
doing because they see a nice green pattern in their URL bar, yet they
don't even know that everyone around knows what site they're surfing
and that based on the MAC you can even classify who does what when
multiple users do the same in parallel.

Internet protocols are complex and the details are not easy to understand
for the non-tech people. Continuously telling them "don't worry, if you
see a green lock it means nobody can see what you're doing" is a lie and
just trains them never to wonder. Users need to be taught reality first,
and once they're aware of the risks it becomes possible to offer various
protection grades. If you do it the reverse way it will be even more
complicated for them to know when it's safe and when it's not.

At minima, there could be a help box in browsers saying what is visible
and what is not, for each connection :

   Do people around me see what site I'm surfing Yes/No
   Do people around me see the contents I'm retrieving/sending Yes/No
   May people around me pretend to be the website and see everything I do Yes/No
   Does the network administrator see what site I'm surfing Yes/No
   Does the network administrator see the contents I'm retrieving/sending Yes/No
   May the network administrator pretend to be the website and see what I do Yes/No
   Does the network administrator have a way to recognize me next time Yes/No
   Does the website have a way to recognize me next time Yes/No
   Does the website know where I am located Yes/No
   Does the website have more info about me Yes/No
   Do third party web site know what I'm seeing on this web site Yes/No

etc...

Depending on clear/encrypted/self-signed/authenticated, and same for proxies,
the results above will change and may already surprize a huge number of users.

Willy

Received on Thursday, 20 November 2014 06:13:27 UTC