Re: [saag] The Mathematical Mesh

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Apr 23, 2019 at 8:16 AM Ben Laurie <[e-mail]> wrote:

>
>
> On Mon, 22 Apr 2019 at 20:33, Phillip Hallam-Baker <[e-mail]>
> wrote:
>
>> The primary focus is enabling real users to manage public key pairs on
>> their devices without being aware that they are doing it. Securely
>> establishing a set of public key pairs on each device and providing a
>> validation path to the user's personal axiom of trust is the main idea
>> here. Because if we achieve that, we are 80% of the way to securing almost
>> any communication pattern.
>>
>
> Where is the user testing for this? BTW, seems to me if users are not
> aware that they are doing it, they will also not be aware when they are not
> doing it. That doesn't seem like a path to security to me.
>

Please make that point to the Chrome team who are busy stripping out the
security indicators so users don't know if they are on a secure site or
not.

I have done extensive user testing and come to the conclusion that almost
none of it gives useful results. Most 'usability' testing methodology is
designed to enable sales. So in 1980 when they started this, Apple was
really interested in how to make the first 20 minutes of use as easy and
productive a possible because that is the length of a typical sales
session. What concerns me is how people behave in normal use when faced
with an attack.

The usability people do tests that tell them the security indicators are
useless and strip them out so the user has no information to tell them
whether something is secure or not. And not just Google's usability people,
they all want to make the system easier to use by removing security. If you
set up the test to look at people's behavior over short time intervals you
will get a certain result. You also get that same result if you keep
changing the security indicator.

There are two concerns that must be addressed if a system is going to be
usably secure:

1) The user must not be required to think about security when they are
focused on their tasks.
2) The user must have the information they need to understand if their
security concerns have been met.

There are currently three device connection protocols, all provide a work
factor of 2^120 or better.

If we are using QR codes to connect devices, we can transmit the necessary
information without the user needing to notice that is what we are doing.
Otherwise, there are many existing protocols that make comparison of 15-30
character base 32 encoded strings as the basis for mutual authentication
and these have proved effective and acceptable.