Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-30 Thread n...@cock.li
I came across this thread from the weekly news post for this week, so please excuse me if I've missed some from just skimming through the posts. Having randomart/gravatars/poems/etc seems like a rather interesting topic, but seriously adding it to tor, there seems to be a few problems in my mind:

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-21 Thread Georg Koppen
Yawning Angel: As much as all of these are important issues, if we search for a solution that works for absolutely everyone, then we will never implement anything, because IMO no such thing exists. I sort of have mixed feelings about this in general, but since enough people seem to think

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-21 Thread Tom Ritter
On 20 August 2015 at 09:24, Jeff Burdges burd...@gnunet.org wrote: I first learned about key poems here : https://moderncrypto.org/mail-archive/messaging/2014/000125.html If one wanted a more language agnostic system, then one could use a sequence of icons, but that's probably larger than

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-21 Thread R. Anthony Lomartire
I like the idea of a drop down notification type deal that displays that you have not visited this site before. And implement that as a default off option in TBB. This lets the user decide if they accept that tradeoff. On Fri, Aug 21, 2015 at 5:11 PM Tom Ritter t...@ritter.vg wrote: On 20

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Jesse V
Jacek Wielemborek d33...@gmail.com writes: George Kadianakis pisze: Some real UX research needs to be done here, before we decide something terrible. Just curious, has anybody seen any cognitive studies on the SSH randomart visualisation? I always found them impossible to remember.

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread teor
On 21 Aug 2015, at 02:56, Jesse V kernelc...@riseup.net wrote: Jacek Wielemborek d33...@gmail.com writes: George Kadianakis pisze: Some real UX research needs to be done here, before we decide something terrible. Just curious, has anybody seen any cognitive studies on the SSH

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Jacek Wielemborek
W dniu 20.08.2015 o 15:49, George Kadianakis pisze: Some real UX research needs to be done here, before we decide something terrible. Just curious, has anybody seen any cognitive studies on the SSH randomart visualisation? I always found them impossible to remember. Perhaps adding a bit more

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Jeff Burdges
I first learned about key poems here : https://moderncrypto.org/mail-archive/messaging/2014/000125.html If one wanted a more language agnostic system, then one could use a sequence of icons, but that's probably larger than doing a handful of languages. I once encountered an article claiming

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Yawning Angel
On Thu, 20 Aug 2015 17:02:24 +0300 George Kadianakis desnac...@riseup.net wrote: Jacek Wielemborek d33...@gmail.com writes: W dniu 20.08.2015 o 15:49, George Kadianakis pisze: Some real UX research needs to be done here, before we decide something terrible. Just curious, has

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread George Kadianakis
Jacek Wielemborek d33...@gmail.com writes: W dniu 20.08.2015 o 15:49, George Kadianakis pisze: Some real UX research needs to be done here, before we decide something terrible. Just curious, has anybody seen any cognitive studies on the SSH randomart visualisation? I always found them

[tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread George Kadianakis
Hello, this mail lays down an idea for a TBB UI feature that will make it slightly harder to launch phishing attacks against hidden services. The idea is based on hash visualizations like randomart [0] and key poems: --- | o=. |

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Yawning Angel
On Fri, 21 Aug 2015 04:39:14 +1000 teor teor2...@gmail.com wrote: [snip] Visual schemes are only helpful to users who have the appropriate level of visual ability or processing: * as has already been mentioned, colouring schemes are not as useful to the colourblind; * facial recognition

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Yawning Angel
On Thu, 20 Aug 2015 11:00:51 -0400 Ian Goldberg i...@cs.uwaterloo.ca wrote: On Thu, Aug 20, 2015 at 02:41:51PM +, Yawning Angel wrote: What would be useful here is the number of onion addresses an average user visits. If it's small, something like this would probably be sufficient:

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Ian Goldberg
On Thu, Aug 20, 2015 at 02:41:51PM +, Yawning Angel wrote: What would be useful here is the number of onion addresses an average user visits. If it's small, something like this would probably be sufficient: 0. Browser generates/stores a long term salt. 1. On onion access, calculate

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Adam Shostack
On Thu, Aug 20, 2015 at 11:00:51AM -0400, Ian Goldberg wrote: | I'd caution about the poker hand, though. One year when I taught | first-year undergraduate CS, we included an assignment that had to do | with decks of cards and card games. A surprising number of people had | never seen decks of

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Jeff Burdges
A per browser salt is a wonderful idea. It's basically impossible to fake even small key poems or whatever if you cannot guess their salt. Just some thoughts : - The salt should be a text field users can interact with easily. It could be displayed prominently in the extensions config, or