HJ wrote:
Anyway, you may, or may not, nitpick about the used text and what not, but a fact is a fact, this works for MultiZilla users, but what do you think about this?
So this is an implementation of "New Site", from http://www.gerv.net/security/phishing-browser-defences.html#new-site ?
Yeah, that seems pretty much the same as what I did...I must be on the right track, this time :-)
If so, that's great :-) However, I have a few comments on the implementation:
Sure, burn away, after all this is a concept ;)
- The text used to explain the feature isn't at all clear to average users. What is an "encrypted security key"? What does it mean if it's missing? The message bar doesn't say.
- IMO, there's no need for preferences for this stuff. Firefox isn't going to have UI for an IDN preference, or a "display as punycode" preference.
So you are forcing all people to look at punycode all the time, even if that makes it worse? What if I have a punycode look alike domain? Yeah, that will make it harder I guess.
- The explanatory text in the popup is too verbose.
Ok, but which part? The top, middle or bottom?
Please note that that middle part is in fact an <expander> but without the CSS love that it needs.
Now, you might wonder, do we really need this, yes we do, because my bank site (for example) makes use of a chromeless window, without navigation- and status bar, so I need to have a way of displaying the certificate info, or I would be lost and it would still very easy to deceive our users without this kind of information.
Let me ask you another question; do you trust the site, the certificate, the domain holder or the CA that issued that certificate?
- I don't think it's necessary to involve the whole "Master Password" thing. Most users don't use them anyway.
The question is, should we explain them why they need one, or do we wait till some ill extension writer steals your sensitive data? I could ask you this; why have a Master Password feature in Mozilla/Mozilla Firefox, if "Most users" don't use it (your words)? Not using an important feature should be on the educational list for end users, how else would this anti phishing prevention work, because humans are still, and will always be, the weakest link...
On a site note, do you have "wallet.crypto" set to 'true' or 'false'? I keep telling people to use 'true' and I made an extension to proof/explain why, I think that was about two years ago now. Some people, and I'm not pointing fingers, would have called that *the* first "MafiaZilla" extension :-)
A "hashed SSL domain history" is even less privacy-invading than
keeping a cache of SSL certificates, which is a fairly uncontentious thing for a browser to do.
Good, because I don't keep certificates cached, that would be insane, but I keep a cache of hash keys, made out of the serial number and SHA-1 fingerprint of the certificate. Note the "MultiZilla validates websites that utilize SSL authentication..." part of the BIM text. How else can we validate certificates?
Did you consider adopting the UI suggestions in my paper?
I've said this before, and I keep repeating myself over and over again; go to a local school and ask young children what it is and you will find out that the 'silly character' suggestion doesn't stand long.
Also, using "new site" is a bit blurry to me
Is it a new domain name, are you visiting the site for the first time, didn't you store a key for it, did you clear your SSL History or are you using a different profile/computer system? What about theme and extension authors, they can undo/change/hide this, so that won't work either.
What if I hide my status bar? Are you (Mozilla Firefox) re-enabling "MY" statusbar, just to be able to display that silly lock and text again?
Oh btw, and not being able to clear SSL History, other than removing the file, is not a good thing, just think about public Internet spots.
Think about this; John Doe visits https://www.majorbank.com in an Internet cafe, and you're next, right, you shouldn't visit your bank site in a public Internet Cafe, but that's what happens every day, more than you can imagine.
Ok, so now Jane Doe visits this Internet cafe, hopefully the owner is not a bad person, because they can already 'steal' lots of handy/important data for criminal use, anyway, she visits the same phishing site, without knowing it because she thinks that this is the right site, after all, there's no warning, right? So what happens to her money/bank account?
/HJ _______________________________________________ Mozilla-security mailing list [email protected] http://mail.mozilla.org/listinfo/mozilla-security
