Usability Workshop Part 3

Part 1 Part 2

Now we are now on to the issue of metadata. Most of this is better understood from the papers. Kenneth Wright is currently demonstrating a multi-level authentication scheme.

Now we are having the usual reductionist security analysis, "this will not work because". I think it misses the point entirely, we have to unlearn how to do that. It is the security of the whole system that matters. There is very little that can be done to eliminate man in the middle attacks without secure chrome. But they can be very effectively controlled by an MSS provider. If each attack costs the attacker one bot that is pretty good from my point of view.

MEZ has just elaborated on the 'friends and family' idea. She thinks there is something there, address book filtering, flikr, kazar, (I would add PGP!) something like that.

One theme that keeps re-appearing though is a series of small measures that are relatively simple individually but in combination could have a big effect:

Chrome Protection: Don't let JavaScript or Active-X content stomp on the trust indicators, don't allow frameless pop-up windows.

Trustworthy key storage: The O/S stores the private key in a secure compartment

X.509 Logotypes: Hurray! Its not just me, most speakers seem to be thinking about them, several seem to assume they are just going to be 'turned on'.

Some others I would add:

Reverse Firwalls: Reduce the value of a bot to the minimum possible. The less bandwidth a bot has the less the value to the botmaster.

Block unsolicited executable content Get email providers to block unsolicited executables by default. Cut off the distribution of viruses at the source.