Adam Back wrote:
I would think it would be safer to block the site, or provide a
warning dialog.
Before we do the first redirection, we do ask the user. However, since
TrustBar is really part of our research on secure usability, we are
aware that asking the user is a very problematic mechanism. Namely, we
expect most users to simply click `yes` and forget about it. That's why
I referred to it as default.
Seems that I must repeat my request: a lot of you seem to agree that
current browser security UI is broken, here are we developed a seemingly
usable tool trying to fix it, takes 2-3 minutes to install - why don't
you spend that time and then tell us how to improve (or to stop wasting
our time as well as your 5 minutes)? Of course, what we'll really love
(for our usability data) is for you also to get some non-expert users to
try to use the system... someone who really uses e-banking and cares
about the (very real threat) of spoofing/phishing...
(This is what I was expecting when I started reading
the head post; I was bit surprised at the interventionism to actually
go ahead and "fix" the site, maybe that would be a better default
behavior).
Actually, from other feedback we got, I think we may extend the
mechanism to be even more active, to protect also these pages which are
not in our list of `known` unprotected login sites with a protected
alternate site. What we may do is to archive a copy of these sites in
your machine, and redirect you to the archived copy if/when the site
`really` changes. This is a bit tricky as we need to ignore these small,
insignificant changes that many of these sites do.
btw Regarding unadvertised SSL equivalents, I have noticed if you
login to gmail, you get SSL for login, but then http for web mailer.
However if you edit the URL after login to https, it appears to work
ok over SSL also.
cool, this may also be something we can do for users (essentially
requires us extending the auto-redirection features with wildcard
functionality).
--
Best regards,
Amir Herzberg
Associate Professor
Department of Computer Science
Bar Ilan University
http://AmirHerzberg.com
Try TrustBar - improved browser security UI:
http://AmirHerzberg.com/TrustBar
Visit my Hall Of Shame of Unprotected Login pages:
http://AmirHerzberg.com/shame
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
