Subject: [pkix] FW: Are human readable images really all that important? [was: WGLC for draft-ietf-pkix-certimage-03]

From: Stefan Santesson <[email-masked]>
Date: Mon, 14 Dec 2009 21:57:04 +0100

All,

Forwarding this message from Thomas Hardjono. For some reason his mails have
failed to reach the list.

/Stefan

------ Forwarded Message
From: Thomas Hardjono <[email-masked]>
Date: Mon, 14 Dec 2009 12:23:35 -0500
To: <[email-masked]>
Cc: Stefan Santesson <[email-masked]>
Subject: FW: [pkix] Are human readable images really all that important?
[was: WGLC for draft-ietf-pkix-certimage-03]

(Resending due to mail-list related problems)

-----Original Message-----
From: Thomas Hardjono [mailto:[email-masked]]
Sent: Thursday, December 10, 2009 4:21 PM
To: [email-masked]'
Subject: RE: [pkix] Are human readable images really all that important?
[was: WGLC for draft-ietf-pkix-certimage-03]

Apologies for jumping in late into this discussion.
(I'm just on way too many lists nowadays).

I've been reading this thread, and I really don't
understand what the big deal/opposition is about
regarding the cert-image draft.
Siddarth has already shown a couple of examples
from VeriSign (notably the PTA Agent from a few years ago).
The fact that a large CA like VeriSign already
contemplated the same idea indicates (to me at least)
that cert-image has some merit.

So I think the PKIX WG should publish this doc as an RFC/standard
and just let the markets decide: (a) how to use the feature
and (b) how to present the corresponding UI to the user.
The CAs have enough marketing studies/surveys to decide,
and they will determine whether to offer (or not) the cert-image feature
to Enterprise customers and consumers.

/thomas/

Stephen Farrell wrote:
> 
> Peter Gutmann wrote:
>> Stefan Santesson <[email-masked]> writes:
>>
>>> I have heard the usability study arguments for a very long time. Some of
them
>>> seems to be very old and others I have looked closer into either comes
with
>>> flawed conclusions or don't apply to this problem.
> 
> 
>> In any case the overall point of the studies, that users don't want to
know
>> about certificate details, is quite apropos and still very relevant.  If
users
>> don't care about X and don't use X then giving them more X isn't going to
>> work, no matter how you dress it up
> 
> I think Peter's got a real point here. I don't recall seeing any
> studies, ever, that said something like "users found PKI UI feature
> foo really useful." One can fairly criticise some of PKI usability
> studies for various reasons, but given that PKI's been about so
> long, and security usability has been an academic hot(-ish) topic
> for a few years now, if its true that no academic has published
> a study that found users got significant benefit from the UI
> associated with PKI, then that'd surely be significant.

Let's step back from this for a minute. While I agree with Peter,
that no amount of UI information in a certificate is ever going
to make them more useful or palatable to end users, that is not the
actual question we should be asking here.

The questions we should be asking are:
a) is it ever useful to show a user something about who they are
  talking to (doing a transaction with, etc) on a network?
b) it is ever helpful to show them logos or other images
  as part of a)?

and what we should be asking for this discussion is:

c) if we think the answers to a) and b) are yes, where should we get
the images we show the user, and would a certificate used to
authenticate the connection be a useful source of an authenticated
image?

Note: I'm not talking about showing or even mentioning certificates to
the user. What I'm talking about is using a certificate as a
potentially authenticated source of information that I *could* show a
user in a context that they might actually find useful.

> 
> Does anyone know of such a study? (And I don't mean a
> vendor-driven report, I mean something peer-reviewed & done
> independently by someone who does usability studies.)

I think there is at least some support for a:

Stoll, J., Tashman, C. S., Edwards, W., and Spafford, K. 2008. Sesame:
informing user security decisions with system visualization. In
Proceeding of the Twenty-Sixth Annual SIGCHI Conference on Human
Factors in Computing Systems (Florence, Italy, April 05 - 10, 2008).
CHI '08. ACM, New York, NY, 1045-1054. DOI=
http://doi.acm.org/10.1145/1357054.1357217 (available here:
http://www.cc.gatech.edu/~keith/pubs/chi2008-sesame.pdf)

And some really really sketchy support for b:

Smetters, D. K. ; Stewart, P. Breaking out of the browser to defend
against phishing attacks. Fifth Conference on Email and Anti-Spam
(CEAS 2008); 2008 August 21-22; Mountain View, CA. (available here:
http://www.parc.com/content/attachments/breaking_out_browser_6496_parc.pdf)

What there isn't yet support for is whether image information in
certificates specifically is useful to someone building a UI that
actually helps an end user stay secure. That would require more
user studies, and a significant amount of requirements analysis
to figure out what the user's needs actually are.

My own personal guess about whether it's useful is that the current
approach to certificates is so far off the mark for end users that
this isn't going to help; and standardizing it now without real
requirements might screw it up for the long term. One could even make
things worse, if an attacker can get a familiar image into an
illegitimate cert and make a user overconfident in their security
as a result.

> 
> Maybe cardspace, or this proposal, is different though. I don't
> know. But asking if there's evidence that it'd be effective seems
> fair to me.

Yep, but keep in mind, this is a low-level building
block. It's hard to ask if it'd be effective a priori -- maybe
the system I built with it would suck. But maybe someone cleverer than
me would be able to use it to make something really useful. I do
wonder about the fact that nobody starts these standardization
processes by building toy systems and showing that they are useful,
(user studies and all) before attempting to spin them up to the Wider
World.

> 
> PKI is as good as we have for lots of things, but maybe,
> just maybe, UI design should be driven by people who do that
> for a living and not by PKI.

I absolutely agree. (Critical disclaimer: I'm not a UI designer or an
ethnographer. I just collaborate with them. )

--Diana Smetters

_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

------ End of Forwarded Message