Subject: RE: Extra Security Considerations for Logotypes (was Re: draft-ietf-pkix-logotypes-06.txt)

From: "Trevor Freeman" <[email-masked]>
Date: Mon, 28 Oct 2002 16:38:41 -0800

I would only make a minor modification because there are classes of
visually impaired people who have some limited vision but would still
benefit from the audio logotypes.

For audio logotypes (particularly in applications for the visually
impaired, where some or all content is rendered in an audio form)....

-----Original Message-----
From: Dean Povey [mailto:[email-masked]] 
Sent: Monday, October 28, 2002 3:55 PM
To: Housley, Russ
Cc: [email-masked]
Subject: Extra Security Considerations for Logotypes (was Re:
draft-ietf-pkix-logotypes-06.txt)

On Fri, 25 Oct 2002 11:52:00 -0400, "Housley, Russ" wrote: 
>Dean:
>
>Reading the content of the certificate is what we are trying to avoid.
For 
>the people without disabilities, the image is intended to provide a
quickly 
>identifiable affiliation.  We want a similar aid to the visually
disabled.

While I agree with the sentiment, I'm not sure I agree with the
mechanism. 
However, I am willing to acquiesce in the interest of moving the draft
forward.

On the security issue I raised, can we at least add something like the
following text to the Security Considerations.

"Applications that make use of certificate logotypes MUST ensure that 
their presentation cannot be masqueraded by the display of other dynamic

mutlimedia content.  For example, it should not be possible for an image

or audio content on a web page to be confused with a logotype for a 
certificate.  For image logotypes this MAY be done by reserving part of 
the user interface for the display of logotype images, and ensuring that

no dynamic content can display an image at that location.  For audio 
logotypes (particularly in applications for the visually impaired, where

all content is rendered solely in an audio form), there MUST be a 
mechanism for the user to distinguish the logotype audio, such as by 
requiring an action by the user before the audio is played."
-- 
Dean Povey,             |em: [email-masked]|JCSI: Java security
toolkit
Wedgetail Communications|ph:  +61 7 3023 5139   |uPKI: Embedded/C PKI
toolkit
Level 14, 388 Queen St, |fax: +61 7 3023 5199   |uSSL: Embedded/C SSL
toolkit
Brisbane, Australia     |www: www.wedgetail.com |XML Security: XML
Signatures