RE: DNSSEC indicator

I still think DNSSEC will be more valuable if it's visible to the end
user.  True, most won't care.  But some will, especially if it can be
presented in an intuitive and jargon-free fashion in the UI.

I think this discussion goes right to the heart of the core WSC premise:
We believe today's browsers display security context in a way that is
incomplete, misleading, misunderstood, and therefore often ignored.  We
believe it should be possible for browsers to display security context
that is more accurate, complete, intuitive, and actionable.
(If we didn't believe this why would we invest time in the WSC WG?)

I feel DNSSEC -- if it comes to fruition -- is too important a piece of
the security context for us to ignore it.

------ Forwarded Message
From: "Stuart E. Schechter" <ses@ll.mit.edu>
Subject: Re: DNSSEC indicator

> From: <michael.mccormick@wellsfargo.com>

...  
> My personal opinion is DNSSEC should probably be another input to the 
> agent security context display along with the others we've talked 
> about (e.g., SSL/TLS).  There are some practical obstacles to overcome

> -- for instance the name resolver built into the client OS or browser 
> has to be DNSSEC-capable as a prerequisite for this -- but it seems it

> ought to be on the roadmap.  I believe DNSSEC has more potential
benefit if it's visible to end users.

Michael:

   I'm a strong advocate of DNSSEC, but I'm certain it will fail users
are required to notice an indictor of its presence or absence.  SSL
indicators are visible to end users and users don't notice them.

   I have been working on a new standard that would employ DNSSEC to
reduce, rather than increase, the amount of security information that
users need to be made aware of.  The standard removes the need for users
to pay attention to the browser padlock icon and other HTTPS indicators.
When I've talked to folks at Mozilla and on Microsoft's IE team, I've
found the generally agree that this is the area where DNSSEC can provide
value to them.  Alas, because it introduces a new record into the DNS,
it is out of scope for this working group.

   When it comes to security indicators, more is not necessarily better.

   Cheers

   Stuart

Received on Friday, 13 April 2007 18:33:54 UTC