Re: [Secdispatch] [saag] The Mathematical Mesh

[Nico Williams <[e-mail]>]

On Wed, Apr 24, 2019 at 09:53:01AM +0100, Ben Laurie wrote:
> On Tue, 23 Apr 2019 at 22:23, Phillip Hallam-Baker <[e-mail]>
> wrote:
> > On Tue, Apr 23, 2019 at 8:16 AM Ben Laurie <[e-mail]> wrote:
> >> On Mon, 22 Apr 2019 at 20:33, Phillip Hallam-Baker <[e-mail]>
> >> wrote:
> >>
> >>> The primary focus is enabling real users to manage public key pairs on
> >>> their devices without being aware that they are doing it. Securely
> >>> establishing a set of public key pairs on each device and providing a
> >>> validation path to the user's personal axiom of trust is the main idea
> >>> here. Because if we achieve that, we are 80% of the way to securing almost
> >>> any communication pattern.
> >>
> >> Where is the user testing for this? BTW, seems to me if users are not
> >> aware that they are doing it, they will also not be aware when they are not
> >> doing it. That doesn't seem like a path to security to me.

Users absolutely have to be capable of being at least minimally aware.

Perhaps we should leave UI issues till much later, provided we get
consensus on a few "rules", with these as my proposal:

0) users absolutely have to be [capable of being] at least minimally
   aware of security

1) security UI indications should be minimally intrusive within
   constraint (0)


I'm sure there are many UI design options, such as:

 - non-modal  positive indicators
 - non-modal? negative indicators
 - reject negative interactions outright, with some sort of modal
   introducer option ("scan your peer's QR code" and such)
 - etc.

Perhaps with different UI choices for different kinds of devices.
Changes in device capabilities and form factors may well require
re-thinking UI design choices.

I don't care as much which if any or even all of the above are used, as
long as we get (0) and (1).

The degree of security indication UI intrusiveness is up for debate.  We
should give implementors guidance, but still let them experiment.

> > Please make that point to the Chrome team who are busy stripping out the
> > security indicators so users don't know if they are on a secure site or
> > not.
> >
> 
> That is not what is happening. Chrome is switching from showing positive to
> negative indicators.

Thanks for this.  Can you provide a link to justification/blogs/research
about that change?

Nico
--