Re: [Ietf-http-auth] Request for review and consensus -- draft-hartman-webauth-phishing

[SM <[e-mail]>]

Hi Sam,
At 06:05 09-09-2008, Sam Hartman wrote:
>One of my goals in section 1.1 was to avoid doing that.  Assuming the
>IETF had consensus behind the text in section 1.1, how would these
>requirements constrain other paths?

Because it can be used as a set of requirements.

May I ask why it is important that this document becomes an IETF 
recommendation?

>Would you be happier with  "We assume that users are interested in 
>combatting phishing, but cannot be expected to learn the details of 
>security protocols, certification practices, and the like."

You could drop the first sentence.  You already explained the 
problems for users in the rest of that paragraph.

At 09:01 09-09-2008, Tom Yu wrote:
>     "We assume that users wish to protect themselves, but are willing
>     to expend only limited effort to combat phishing; they will avoid
>     an interface if they find it too complicated.  This can result in
>     the user preferring a simpler insecure interface to a more complex
>     but more secure one.  Alternatively, a user more fully informed of
>     the risks may abandon any effort to access a service if the choice
>     is between using a complex, secure interface and using a simple
>     but known-to-be-insecure interface."

That's a good summary of the problem from a user angle.  It's a user 
interface design consideration.

Regards,
-sm