Re: Proposal: Marking HTTP As Non-Secure

On 7/02/2016 22:23 pm, Kevin Chadwick wrote:
>> This is demonstrability unhelpful.  UI/UX research has shown
>> consistently that people do not notice the absence of positive
>> indicators.
>>
>> Some things to read:
>> - Trust Me: Design Patterns for Constructing Trustworthy Trust Indicators
>> - The emperor’s new security indicators in Proceedings of the 2007
>> IEEE Symposium on Security and Privacy,.
>> - Use of Visual Security Cues in Web Browsers in Proceedings of the
>> 2005 Conference on Graphics Interface
>
> So, are you against the proposal then?
>
> I am, reversing the original design is simply ridiculous.


The problem with this debate is understanding what the goal is.

The goal is to make HTTPS work.

Unfortunately it doesn't work if HTTP is sitting along side HTTPS.  OK, 
HTTPS works as long as we rule HTTP as "out of scope" but that's a 
security industry self-deception.  For the users, HTTP is in scope, period.

HTTPS does not deliver when alongside HTTP.  So we have to sacrifice:

1. ditch HTTPS.
2. ditch HTTP.
3. ditch them both, do something else.

There is a large commercial sector which owns significant parts of 
standards-space that refuses to do 1.  The common people aren't going to 
be happy with 2, but that's what they're being given.  3. is theoretical 
at best until someone does the work, *and* the commercial sector behind 
HTTPS is given a bribe to go along.

Is where we are.  We can all have a say but it will probably be ignored. 
  Nobody gets out of this without some tears.  But at least lets 
understand *why this is happening* :  HTTPS won't work if there is an 
easy downgrade to HTTP.



iang

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security