What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?

Question

This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective.

What business/organisation(s) would have:

• Sufficient technical skill to evaluate technologies needed for safe, secure web browsing
• The capacity to publicly recommend a set of technologies to achieve the same
• Does not have conflicting goals of Certificate Authorities nor other goals of other businesses/governments
• Would be likely to revise those recommendations as new information regarding risk and in-the-wild threats were made available

My idea is to have a "Connection Security Index" that is associated with the HTTPS lock Icon.... it's somewhat analogous to the rating approach of the Windows user experience:

I intend work with those companies, and do what is needed to make what I believe is a small yet effective improvement to the user experience regarding HTTPS. (see this link for the change I'm looking to make)

Answer 1

In terms of your question, I don't think there is any one organisation. OWASP gives good detail on the ten obvious things you should get right, but that should be a bare minimum - because there are so many aspects of security, and different browsers, OS'es, plugins, ways to access the Internet etc I'd be surprised if any single organisation could do it.

I think that while this is a very interesting area in user interface design the end user won't care, so I don't think it will help security. If you give a red-bad, green-good to a typical, non-technical user, they will not think any further. If you provide a different green-good the majority are still going to see it as good, not as a different kind of good.

Answer 2

What business/organisation(s) would have:

Sufficient technical skill to evaluate technologies needed for safe, secure web browsing

OWASP

The capacity to publicly recommend a set of technologies to achieve the same

not actually, still CERT as several nations have it

Does not have conflicting goals of Certificate Authorities nor other goals of other businesses/governments

None. Directly or Indirectly they play or get played.

Would be likely to revise those recommendations as new information regarding risk and in-the-wild threats were made available

Almost every major technology/standards have separate organization taking care of it & trying their best to patch up the reported bugs. Except few corporates abandoning their products to promote (force) newer releases.

Answer 3

The answer is: there is no one single organization who you should be talking to, if you want to convince browser vendors to change their browsers. Instead, you would need to work with the major browser vendors and the standards groups (WHATWG, etc.).

I think a key question is: how do we know whether your idea will be beneficial to most users? Or, to put it another way, I don't think you are asking the right question: instead of asking "what organization should I talk to?", it seems to me the most important question is "what evidence is there that a 'Connection Security Index' will have value?". I suspect that's the first question browser vendors will ask you, once you start talking to them, so that's where I think you should start. Myself, I would want to see a user study demonstrating its value to users. My guess is that users won't find it useful and won't notice, so this feature will not add much value -- but that's just a guess. I'd much rather have evidence than guesses.