[abfab] Fwd: draft-ietf-abfab-usability-ui-considerations-01 Review

[Colton Shields <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

draft-ietf-abfab-usability-ui-considerations-01 Review

>From reading the draft I feel like I understand the majority of the
language and what this draft is trying to accomplish. I did not find
any fundamental flaws with the draft. My comments are minor text changes.

Below are my comments.

Section 3 Considerations
- ------------------------
Could be useful to have examples of each terminology, and what they
look like. Helps readers get context. In Section 5.1 last sentence of
Paragraph 1 it mentions that a NAI looks like an email address. It
would be nice to have examples at the beginning of the document so
readers can wrap their brains around what NAI and other terminology
mean specific to this document.

GSS-API is used several times in the document but is never explained
or defined. Add it to section 3 as bullet point of the terminology of
the document, or the first time it is used, define it.


Section 3 Last Paragraph
- ------------------------
      "Trust anchor: An authoritative source of verification of a
      particular ABFAB service or Identity Provider, used to allow
      authentication of a server using X.509 [RFC5280].  Typically a
      commercial CA to allow authentication via chain of trust, or a
      preconfigured non-commercial certificate (e.g. self-signed)."

I am unaware of what 'CA' is referring to. I assume it means a
'Certificate Authority' but I am making that assumption from context.
Replace 'CA' with 'Certificate Authority (CA)', or whatever CA
represents.

Section 4 Paragraph 1 Last Sentence
- -----------------------------------
"The simplest way to achieve the desired effect would be a process
that simply takes the credentials from the currently logged in user"

Remove 'simply'. It is already known that this is the simplest way.


Section 5.1 Last Paragraph First Sentence
- ----------------------------------------

" Beyond terminology, careful thought needs to be given to the paradigm
   to use when presenting identity to users, as identities and services
   are abstract concepts that some users may not find is easily
   understandable."

Turn into two separate sentences:
"Beyond terminology, careful thought needs to be given to the paradigm
to use when presenting identity to users."

"Identities and services are abstract concepts that some users may not
find easy to understand."


Section 5.1 Last Paragraph Last Sentence
- ----------------------------------------
"Implementers may wish to keep such abstract
   concepts, or may wish to examine attempts to map to real world
   paradigms, e.g. the idea of using "Identity Cards" that are held in
   the user's "Wallet", as used by Microsoft Cardspace."

Unsure of what this sentence is trying to say. Seems like a run on.


Section 5.2 Last Sentence
- -------------------------
"But for simplicity just the word "service" probably usually suffice."

Remove 'probably' or 'usually'. Use one or the other but not both.


Section 6 Second Sentence
- -------------------------
"This section first looks at what information associated with an
identity will need to managed"

add 'be' to the sentence above to look like the following:

"This section first looks at what information associated with an
identity will need to 'be' managed"


Section 6.1 Paragraph 5
- -----------------------
Unsure of what EAP means. Define in line, or define in Section 3.


Section 6.2 Paragraph 1 Last sentence
- -------------------------------------
Mac and Linux options are listed. Maybe list a Windows option if there
is one. (I personally don't like Windows, so if you don't add this I
won't be mad :) )


Section 6.3.1 Last Paragraph
- -----------------------------
"An Identity Selector that allows for manual addition of identity
   information SHOULD try to ensure that trust anchor information is
   gathered and checked in a secure a manner as possible - where users
   have to enter and confirm all trust anchor information, or be
   required to explicitly agree to an insecure configuration if this is
   not done properly."

Needs to be reworded. Especially this part 'gathered and checked in a
secure a manner as possible'

Possible option
'gathered and checked in a secure manner'



Section 7.1.1 Numbered List 1
- -----------------------------
"such as its GSS Acceptor Name."

Unaware of what GSS Acceptor Name means. Define in line or in Section 3.


Spelling considerations:
- ------------------------

Section 6.1 Paragraph 6 Middle of the paragraph

Replace 'make' with 'makes'

"any implementer is free to use whatever make sense in their
   implementation and conforms to good HCI/UX guidelines."


Great draft, looks good, keep up the good work!

- --Colton









-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - https://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBCgAGBQJT4kxdAAoJEKWz5R7vDXT7V+4H/RAVgs/TRfDtWMF0jmpQMuNZ
B1v3etyH6+ZUXijy3a69RsjKg10QMuACNEbLLzOj8ItxbnIv/qzoIo2BlwLzaqxG
pGEs6+U/mNmUXcU6bHyV5s/6tjiSLy1IDl/Yp+enV/20rq8Z/QGo5BbXnHK+BVar
zEQAJYyikWANNG7WqaaxYj/klhtpWu7tFDylJynwkjL6cILCL/UKWIwP0gazYJLj
OzXaEhQ5AMTeypenFoiZKMnnmmOeTYtUOREDIqXy3iMDnHYSGb5CxQwcyWEwDjbV
GZ3IbaHkjWvWAwNNvmK9ayI0k9es20SqG5wERcx0JPUDEujqBmx+EzcJ++4n18Y=
=fKq/
-----END PGP SIGNATURE-----