Re: Don't favour https ( LC-2382)

 Dear Krzysztof Maczyński ,

The Web Security Context Working Group has reviewed the comments you sent
[1] on the Last Call Working Draft [2] of the Web Security Context: User
Interface Guidelines published on 9 Mar 2010. Thank you for having taken
the time to review the document and to send us comments!

The Working Group's response to your comment is included below, and has
been implemented in the new version of the document available at:
http://www.w3.org/2006/WSC/drafts/rec/rewrite.html.

Please review it carefully and let us know by email at
public-usable-authentication@w3.org if you agree with it or not before 30
April 2010 (Arbor Day). In case of disagreement, you are requested to
provide a specific solution for or a path to a consensus with the Working
Group. If such a consensus cannot be achieved, you will be given the
opportunity to raise a formal objection which will then be reviewed by the
Director during the transition of this document to the next stage in the
W3C Recommendation Track.

Thanks,

For the Web Security Context Working Group,
Thomas Roessler
W3C Staff Contact

 1. http://www.w3.org/mid/D4569F365CCB49B6A29F8664BBF3B3AF@kmPC
 2. http://www.w3.org/TR/2010/WD-wsc-ui-20100309/


=====

Your comment on 5.2 Types of TLS:
> Dear WG,
> 
> Section 5.2 of Web Security Context: User Interface Guidelines seems to
> favour the https scheme over http used with TLS as specified by RFC
> 2817. On the other hand, the W3C Director, TAG, IANA and other parties
> have indicated many times that URI schemes should be employed only if
> they enable identifying with URIs a class of resources semantically
> distinct from what other schemes already cover. Security characteristics
> of access to a resource are orthogonal to the identity of the resource
> itself (proof: the same resource can be made available by both means).
> Therefore, https is redundant and SHOULD NOT be used, since its range
> coincides with that of http. Please redefine “strongly
> TLS-protected” to include http with RFC 2817.
> 
> Best regards,
> 
> Krzysztof Maczyński
> Invited Expert, HTML WG


Working Group Resolution (LC-2382):
We have discussed this. Since we deal with users and the user interface,
we have taken into consideration user impacts. It would be confusing to
users to see an indication of TLS security, such as augmented assurance
(such as with EV) certificates, and an http: URI. This could be further
exacerbated through copy/pasting the URI. We did however change 8.7 to
refer to "TLS-protected HTTP" instead of "HTTPS". 

----

Received on Friday, 23 April 2010 12:31:58 UTC