Re: [Ietf-http-auth] Request for review and consensus -- draft-hartman-webauth-phishing

[Tom Yu <[e-mail]>]

Sam Hartman <[e-mail]> writes:

>>>>>> "SM" == SM  <[e-mail]> writes:
>
>     SM> Quoting a sentence from Section 3:
>
>     SM>    "We assume that users have limited motivation to combat
>     SM> phishing."
>
> Would you be happier with "We assume that users are interested in
> combatting phishing, but cannot be expected to learn the details of
> security protocols, certification practices, and the like."

I think your proposed change above is largely redundant with the rest
of the paragraph that follows it in the I-D.  I think it is more
useful to say:

    "We assume that users wish to protect themselves, but are willing
    to expend only limited effort to combat phishing; they will avoid
    an interface if they find it too complicated.  This can result in
    the user preferring a simpler insecure interface to a more complex
    but more secure one.  Alternatively, a user more fully informed of
    the risks may abandon any effort to access a service if the choice
    is between using a complex, secure interface and using a simple
    but known-to-be-insecure interface."

I know that my suggested text should be condensed more, but I'm trying
to see if that more effectively conveys the intended meaning.

The paragraph in its original form appears to encompass two related
concepts:

* We cannot expect users to be security experts.

* We cannot expect users to expend significant effort to protect
  themselves against risks they only poorly understand.

A complex interface that requires the user to make a security judgment
is doubly flawed, in my opinion, but this appears to be the experience
of Web browsing today.