RE: ISSUE-132: Update Section 10.1 of wsc-xit with information from updated browser lock down wiki page

I would only use a public kiosk that let me view its security settings.
I would only let my children use a school computer (esp. if Internet
connected) that let me view its security settings.
I see no harm in letting a ticket counter agent view security settings on
her terminal if she wants to.
I don't mind if my kids look at security settings on a video game (as long
as they can't change them).

  _____  

From: public-wsc-wg-request@w3.org [mailto:public-wsc-wg-request@w3.org] On
Behalf Of Timothy Hahn
Sent: Tuesday, November 27, 2007 10:14 AM
To: Web Security Context Working Group WG
Subject: RE: ISSUE-132: Update Section 10.1 of wsc-xit with information from
updated browser lock down wiki page



Hi all, 

To be clear, the requirement does not state that the information is not
available.  The requirement states that there is a "usage mode" where the
information is not available. 

Michael McCormick asked for real world examples where this would be
valuable.  I have thought of a couple: 
 - public access terminals (kiosks, user agents installed in libraries, and
schools, etc.) 
 - usage modes for pre-school children (they won't call a help desk, and
their parents probably don't want them calling the help desk - other than
calling their parent for help) 
 - airline ticketing agent usage mode (they are not in the business of
fixing security problems with their user agent.  A support staff for such
terminals would likely have a "admin"/"management" path by which they could
access, even remotely, the security information from the user agent system
without  making the end user recite some security-complex information over
the phone) 

And another example of this type of model: parental restrictions on
television and video game systems.  You have to enter a "admin mode" in
order to even view the settings, let alone change them. 

When a user (or the same user) is ready to deal with security-related
information and settings, let them operate in such a usage mode that allows
for such view and modification. 

Regards, 
Tim Hahn
IBM Distinguished Engineer

Internet: hahnt@us.ibm.com
Internal: Timothy Hahn/Durham/IBM@IBMUS
phone: 919.224.1565     tie-line: 8/687.1565
fax: 919.224.2530




From: 	"Doyle, Bill" <wdoyle@mitre.org> 

To: 	"Ian Fette" <ifette@google.com>, "Dan Schutzer"
<dan.schutzer@fstc.org> 

Cc: 	"Mary Ellen Zurko" <Mary_Ellen_Zurko@notesdev.ibm.com>, "Web
Security Context Working Group WG" <public-wsc-wg@w3.org> 

Date: 	11/26/2007 04:16 PM 

Subject: 	RE: ISSUE-132: Update Section 10.1 of wsc-xit with
information from updated browser lock down wiki page

  _____  





Removing the ability to view security settings appears to be in
conflict with an issue that was brought up a long time ago and noted by
UAAG 1.0

 <http://www.w3.org/2006/WSC/track/issues/40>
http://www.w3.org/2006/WSC/track/issues/40




-----Original Message-----
From: public-wsc-wg-request@w3.org
[ <mailto:public-wsc-wg-request@w3.org> mailto:public-wsc-wg-request@w3.org]
On Behalf Of Ian Fette
Sent: Monday, November 26, 2007 12:40 PM
To: Dan Schutzer
Cc: Mary Ellen Zurko; Web Security Context Working Group WG
Subject: Re: ISSUE-132: Update Section 10.1 of wsc-xit with information
from updated browser lock down wiki page


Yes, but then they call up their help desk / ISP / son / whomever, and
are asked "Is HTTPS over SOCKS checked or unchecked" and they say "I
don't see where that option is...".

I really don't see why the user should ever be prevented from at least
viewing the settings.

On Nov 26, 2007 9:16 AM, Dan Schutzer <dan.schutzer@fstc.org> wrote:
>
>
>
>
> I would agree that a user should always be able to view and modify
> security-related configuration settings, but that if a user agent
does their
> job correctly, it should not be necessary, especially for the user
who would
> have trouble understanding the kind of detailed security
configuration
> settings that one sees today in the Security tab
>
>
>
>  ________________________________
>
>
> From: public-wsc-wg-request@w3.org
[ <mailto:public-wsc-wg-request@w3.org> mailto:public-wsc-wg-request@w3.org]
On
> Behalf Of Mary Ellen Zurko
>  Sent: Monday, November 26, 2007 11:36 AM
>  To: Web Security Context Working Group WG
>  Subject: Re: ISSUE-132: Update Section 10.1 of wsc-xit with
information
> from updated browser lock down wiki page
>
>
>
>
>
>  "A user agent MUST support a mode of operation whereby the user is
unable
> to view or modify the security-related configuration settings. "
>
>  It seems wrong to me that there is a mode where the user is unable
to view
> the security related configuration settings. In every context I've
ever been
> in, having some ability to get to more information if helpful.
>
>  I would remove the "view or" part of this, unless I'm missing
something.