Re: [Ietf-http-auth] Request for review and consensus -- draft-hartman-webauth-phishing

[SM <[e-mail]>]

Hi Tom,
At 11:02 18-09-2008, Tom Yu wrote:
>I have repeatedly heard, from various people in the IETF, statements
>to the effect of "it's a user interface design consideration, so we
>don't have to worry about it".  Your statement above might not be an
>expression of this sentiment, but I think the point is worth
>addressing.

We do have to worry and care about user interface considerations.  I 
was focusing on what part of the problem the IETF may be able to 
address and which part may be better suited for the W3C.

>The IETF should certainly care about user interface design, but in a
>very particular way: the protocols that the IETF designs place
>constraints on user interface designers, and these constraints can
>drive user interface design in ways that dramatically affect the
>security and quality of the end user experience.

Agreed.  That's why it's better to work with user interface designers 
to find out the constraints the protocol places on their work and how 
it affect the security of the end user experience.  It's all part of the chain.

Regards,
-sm