Re: [Ietf-http-auth] Request for review and consensus -- draft-hartman-webauth-phishing

Well said!

I'll add that I believe several IETF protocols are less successful than 
they could be due to our failure to consider and/or address the user 
interface constraints created by our protocols, and our failure to 
communicate advice that could be used to create better user interfaces.

		- Chris

--On September 18, 2008 14:02:38 -0400 Tom Yu <tlyu@MIT.EDU> wrote:

> SM <sm@resistor.net> writes:
>
>> At 09:01 09-09-2008, Tom Yu wrote:
>>>     "We assume that users wish to protect themselves, but are willing
>>>     to expend only limited effort to combat phishing; they will avoid
>>>     an interface if they find it too complicated.  This can result in
>>>     the user preferring a simpler insecure interface to a more complex
>>>     but more secure one.  Alternatively, a user more fully informed of
>>>     the risks may abandon any effort to access a service if the choice
>>>     is between using a complex, secure interface and using a simple
>>>     but known-to-be-insecure interface."
>>
>> That's a good summary of the problem from a user angle.  It's a user
>> interface design consideration.
>
> I have repeatedly heard, from various people in the IETF, statements
> to the effect of "it's a user interface design consideration, so we
> don't have to worry about it".  Your statement above might not be an
> expression of this sentiment, but I think the point is worth
> addressing.
>
> The IETF should certainly care about user interface design, but in a
> very particular way: the protocols that the IETF designs place
> constraints on user interface designers, and these constraints can
> drive user interface design in ways that dramatically affect the
> security and quality of the end user experience.
>
> By their very nature, user interfaces involve the user interacting
> with or interfacing with something.  I will grant that presentation
> details of a user interface, such as graphical layout, are not the
> business of the IETF.  Protocol design affects what information is
> available to a user through a user interface.  It also affects the
> relationships among those pieces of information in terms of time,
> space, and dependencies.
>
> For these reasons, I think that the IETF should pay careful attention
> to how protocol design decisions affect user interface design.
> _______________________________________________
> Ietf-http-auth mailing list
> Ietf-http-auth@osafoundation.org
> http://lists.osafoundation.org/cgi-bin/mailman/listinfo/ietf-http-auth
>