Re: [Bimi] (non)desire for bimi

[Dave Crocker <[e-mail]>]

On 2/16/2019 8:24 AM, Marcel Becker wrote:
> On Feb 16, 2019, at 08:11, Dave Crocker <[e-mail]> wrote:
>> Except, of course, that it will not have that effect on users, because there is extensive experience demonstrating that users mostly do not learn or use such signals.
> 
> While I usually tend to agree with that statement it is — in that
> absolut form — not necessarily true. We know that, given time, users
> are quite capable of learning and using such signals. When
> specifically designed for that task.


In real life, for this kind of task, no, they aren't.

On the average, they don't have an adequate threat model, they do not 
understand the security mechanisms, and they do not allocate the 
necessary time and effort to making the real-time decision.

If you have evidence of average users making security-related decisions 
in real-time -- in the midst of boring, daily tasks -- please provide it.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net