Re: Is the padlock a page security score?

In which case users are going to think this is out of 50, and do the
appropriate re-scaling in their head, or they will think that nothing is
secure and stop doing e-commerce and we kill the web. That, or they just
think that the feature is broken and curse their browser.

On Jan 10, 2008 11:14 AM, <michael.mccormick@wellsfargo.com> wrote:

>  If you feel the available variables only give half the security picture,
> I suppose your UA could define a scoring algorithm that never returns a
> value higher than 50.
>
>  ------------------------------
> *From:* Ian Fette [mailto:ifette@google.com]
> *Sent:* Thursday, January 10, 2008 1:09 PM
> *To:* McCormick, Mike
> *Cc:* hahnt@us.ibm.com; public-wsc-wg@w3.org
>
> *Subject:* Re: Is the padlock a page security score?
>
> I don't know about useless, but I worry a *lot* about giving a false sense
> of security. There could be a site using DNSSEC and an EV-cert, that is
> hosted on some crappy shared server that uses a MySQL 3 database and we
> would give it a 100. That's disturbing to me because it would be very
> misleading and provide a very false sense of security.
>
> On Jan 10, 2008 11:04 AM, <michael.mccormick@wellsfargo.com> wrote:
>
> >  I agree.  I like the weather analogy.  There's no perfect security
> > indicator.  But the more variables an indicator takes into account the more
> > it approaches the asymptote.
> >
> > I guess the alternative would be to throw up our hands and say all
> > security context indicators are useless.
> >
> >  ------------------------------
> >  *From:* public-wsc-wg-request@w3.org [mailto:
> > public-wsc-wg-request@w3.org] *On Behalf Of *Timothy Hahn
> > *Sent:* Thursday, January 10, 2008 12:54 PM
> > *To:* public-wsc-wg@w3.org
> >  *Subject:* RE: Is the padlock a page security score?
> >
> >
> > Hi all,
> >
> > This whole discussion is subjective.  What is useful for one person
> > could very well be useless to someone else.
> >
> > An analogy - weather forecasts about the possibility of rain today.
> >  Does such a score indicate whether I will get rained on?  No.  Does it help
> > me decide whether or not to wear a hat or carry an umbrella?  Yes.  There is
> > no way that people other than meteorologists (and some would argue, even
> > them) will accurately interpret isobars, cloud patterns, and doppler radar
> > to determine whether it will rain.  But people can get a feeling for the
> > chances of rain based on a 0-100% estimate.
> >
> > I think the same is true for the notion of a page security score.  Does
> > it imply that the user will definitely, without a doubt, not get "taken"?
> >  No.  Does it give the user something with which to make a choice?  Yes.  In
> > this light, I still feel that page security scores are good things to
> > consider.
> >
> > Regards,
> > Tim Hahn
> > IBM Distinguished Engineer
> >
> > Internet: hahnt@us.ibm.com
> > Internal: Timothy Hahn/Durham/IBM@IBMUS
> > phone: 919.224.1565     tie-line: 8/687.1565
> > fax: 919.224.2530
> >
> >
> >
> >   From: <michael.mccormick@wellsfargo.com>  To: <ifette@google.com>, <
> > Anil.Saldhana@redhat.com>  Cc: Timothy Hahn/Durham/IBM@IBMUS, <
> > public-wsc-wg@w3.org>, <Mary_Ellen_Zurko@notesdev.ibm.com>  Date: 01/10/2008
> > 01:34 PM  Subject: RE: Is the padlock a page security score?
> > ------------------------------
> >
> >
> >
> > I would ask the same question about a binary indicator.  The padlock
> > does not mean it's safe to enter a credit card.
> >
> > ------------------------------
> > *From:* Ian Fette [mailto:ifette@google.com <ifette@google.com>] *
> > Sent:* Thursday, January 10, 2008 12:26 PM*
> > To:* Anil Saldhana*
> > Cc:* McCormick, Mike; hahnt@us.ibm.com; public-wsc-wg@w3.org;
> > Mary_Ellen_Zurko@notesdev.ibm.com*
> > Subject:* Re: Is the padlock a page security score?
> >
> > I still don't understand what anything beyond a binary result is
> > supposed to tell a user. I'm on a site with "Medium" security - what does
> > that mean? Does that mean that I should give them my credit card or not?
> >
> > On Jan 10, 2008 10:00 AM, Anil Saldhana <*Anil.Saldhana@redhat.com*<Anil.Saldhana@redhat.com>>
> > wrote:
> >
> > Maybe there is an opportunity to associate "High/Medium/Low" or
> > "Strong/Medium/Low" based on page security score with the padlock.
> > *
> > **michael.mccormick@wellsfargo.com* <michael.mccormick@wellsfargo.com>wrote:
> > > Sure, I agree the padlock is a binary representation of a boolean
> > security
> > > score formula based on a single security variable (SSL on main page).
> >  A
> > > degenerate case IMHO - but still technically a page security score.
> > >
> > > A security score algorithm should take into account most (if not all)
> > of the
> > > variables we enumerated under "What is a Secure Page?"  Perhaps the
> > note
> > > should state that explicitly.  Then padlocks wouldn't qualify.
> > >
> > >   _____
> > >
> > > From: *public-wsc-wg-request@w3.org* <public-wsc-wg-request@w3.org>[mailto:
> > *public-wsc-wg-request@w3.org* <public-wsc-wg-request@w3.org>] On
> > > Behalf Of Timothy Hahn
> > > Sent: Thursday, January 10, 2008 10:40 AM
> > > To: *public-wsc-wg@w3.org* <public-wsc-wg@w3.org>
> > > Subject: Re: Is the padlock a page security score?
> > >
> > >
> > >
> > > Mez,
> > >
> > > I'll toss in my view that the padlock is an example of a page security
> > > score.  In most user agents, this seems to be pretty much "binary" (on
> > or
> > > off) though I think we've heard from some folks that there are some
> > > "embellishments" on their display of the icon which would provide more
> > > gradations based on information received.
> > >
> > > On the bright side of such a visible item - it is relatively easy to
> > > describe and for people to grasp the meaning of.
> > >
> > > On the down side of the padlock -  ... well, we've had lots of that
> > > discussion on this list already - see the archives.
> > >
> > > Regards,
> > > Tim Hahn
> > > IBM Distinguished Engineer
> > >
> > > Internet: *hahnt@us.ibm.com* <hahnt@us.ibm.com>
> > > Internal: Timothy Hahn/Durham/IBM@IBMUS
> > > phone: 919.224.1565     tie-line: 8/687.1565
> > > fax: 919.224.2530
> > >
> > >
> > >
> > >
> > > From:         "Mary Ellen Zurko" <*Mary_Ellen_Zurko@notesdev.ibm.com*<Mary_Ellen_Zurko@notesdev.ibm.com>
> > >
> > >
> > > To:   *public-wsc-wg@w3.org* <public-wsc-wg@w3.org>
> > >
> > > Date:         01/10/2008 11:10 AM
> > >
> > > Subject:      Is the padlock a page security score?
> > >
> > >   _____
> > >
> > >
> > >
> > >
> > >
> > > If not, why not?
> > >
> > >          Mez
> > >
> > >
> > >
> > >
> > >
> >
> > --
> > Anil Saldhana
> > Project/Technical Lead,
> > JBoss Security & Identity Management
> > JBoss, A division of Red Hat Inc.*
> > **http://labs.jboss.com/portal/jbosssecurity/*<http://labs.jboss.com/portal/jbosssecurity/>
> >
> >
> >
> >
>