Re: [apps-discuss] [saag] [websec] [kitten] HTTP authentication: the next generation

[Yoav Nir <[e-mail]>]

On Dec 13, 2010, at 5:32 PM, Yaron Sheffer wrote:

> Just like the phrase "I am not a lawyer" is always followed by amateur 
> legal advice (I know that for sure, I've done it myself), the same goes 
> for "I am not a UI expert".
> 
> Two comments:
> 
> - There are in fact a few security-usability experts. I don't know if 
> any of them participate in the IETF. This is an emerging research field, 
> see e.g. http://oreilly.com/catalog/9780596008277.
> 
> - (I am not a UI expert, but...) Devising UI cues is extremely 
> difficult. People will gladly enter their password when the web site 
> displays a JPEG-rendered padlock icon.

I don't know how to stop them, unless the "special" UI cue becomes so ubiquitous, that its absence causes the user to think, "wait a minute. This does not look like authentication!"

As long as every website has authentication that looks different and not different enough from regular web browsing, people are going to accept any web form as a legitimate authentication dialog.

> In fact *legitimate* sites have 
> been known to display such icons, strange as it may sound.
> 
> Thanks,
> 	Yaron