Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective.

What business/organisation(s) would have:

  • Sufficient technical skill to evaluate technologies needed for safe, secure web browsing
  • The capacity to publicly recommend a set of technologies to achieve the same
  • Does not have conflicting goals of Certificate Authorities nor other goals of other businesses/governments
  • Would be likely to revise those recommendations as new information regarding risk and in-the-wild threats were made available

My idea is to have a "Connection Security Index" that is associated with the HTTPS lock Icon.... it's somewhat analogous to the rating approach of the Windows user experience:

Imagine if this rating system applied to connections

I intend work with those companies, and do what is needed to make what I believe is a small yet effective improvement to the user experience regarding HTTPS. (see this link for the change I'm looking to make)

share|improve this question
1  
None. I think that the general business of creating and promoting a web browser is inherently in conflict with security. Tabs are great for usability but in its inception terrible for for security since it shared the same dataset, permissions, cookies, etc between tabs. –  this.josh Sep 26 '11 at 6:52
    
"Show me the code" is a useful saying. People don't really care what you say, but give them a patch, or a browser plugin, and they start to pay some attention. –  DanBeale Sep 26 '11 at 13:51
    
As to that other link; I'm not really sure what you're saying. Why would we have got rid of IE6? There are many people using it even though it's really insecure, why do those people care about another more secure browser that has your icon, if they ignore more secure browsers without it? But comments are not for discussion so I'm happy to take this to chat. –  DanBeale Sep 26 '11 at 13:53

3 Answers 3

up vote 2 down vote accepted

In terms of your question, I don't think there is any one organisation. OWASP gives good detail on the ten obvious things you should get right, but that should be a bare minimum - because there are so many aspects of security, and different browsers, OS'es, plugins, ways to access the Internet etc I'd be surprised if any single organisation could do it.

I think that while this is a very interesting area in user interface design the end user won't care, so I don't think it will help security. If you give a red-bad, green-good to a typical, non-technical user, they will not think any further. If you provide a different green-good the majority are still going to see it as good, not as a different kind of good.

share|improve this answer
    
Good point about the user's caring. If users dont understand the risks, why would they care about security? –  this.josh Sep 26 '11 at 19:06

The answer is: there is no one single organization who you should be talking to, if you want to convince browser vendors to change their browsers. Instead, you would need to work with the major browser vendors and the standards groups (WHATWG, etc.).

I think a key question is: how do we know whether your idea will be beneficial to most users? Or, to put it another way, I don't think you are asking the right question: instead of asking "what organization should I talk to?", it seems to me the most important question is "what evidence is there that a 'Connection Security Index' will have value?". I suspect that's the first question browser vendors will ask you, once you start talking to them, so that's where I think you should start. Myself, I would want to see a user study demonstrating its value to users. My guess is that users won't find it useful and won't notice, so this feature will not add much value -- but that's just a guess. I'd much rather have evidence than guesses.

share|improve this answer

What business/organisation(s) would have:

Sufficient technical skill to evaluate technologies needed for safe, secure web browsing

OWASP

The capacity to publicly recommend a set of technologies to achieve the same

not actually, still CERT as several nations have it

Does not have conflicting goals of Certificate Authorities nor other goals of other businesses/governments

None. Directly or Indirectly they play or get played.

Would be likely to revise those recommendations as new information regarding risk and in-the-wild threats were made available

Almost every major technology/standards have separate organization taking care of it & trying their best to patch up the reported bugs. Except few corporates abandoning their products to promote (force) newer releases.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.