User Trust of a Web Site - Revision history

Tom: /* Other Support Material */

2022-04-08T17:04:14Z

‎Other Support Material

Tom at 05:53, 22 February 2021

2021-02-22T05:53:26Z

Tom: /* Security of Web Site Software */

2021-02-22T05:51:23Z

‎Security of Web Site Software

Tom: /* Problems */

2021-02-22T05:50:58Z

‎Problems

Tom: /* Security of Web Site Software */

2021-02-22T05:50:01Z

‎Security of Web Site Software

Tom: /* Security of Web Site Software */

2021-02-22T05:49:16Z

‎Security of Web Site Software

Tom: /* Security of Web Site Software */

2021-02-22T05:48:18Z

‎Security of Web Site Software

Tom at 05:47, 22 February 2021

2021-02-22T05:47:51Z

Tom: /* Protection of User Authenticators */

2020-07-18T00:37:44Z

‎Protection of User Authenticators

Tom: /* Context */

2020-07-18T00:31:56Z

‎Context

← Older revision		Revision as of 17:04, 8 April 2022
Line 46:		Line 46:
	[[Category:Trust]]		[[Category:Trust]]
	[[Category:User Experience]]		[[Category:User Experience]]
		+	[[Category: Web]]

@@ Line 16: / Line 16: @@
 ==User Experience==
 The [https://indieweb.org/NASCAR_problem NASCAR problem] is a reference to the jumble of branding icons on websites, e.g. 3rd party sign-in/login options or sharing buttons. It is dubbed the NASCAR problem because of these clusters of 3rd party icons/brands on websites resembles the collages of sponsorship decals covering [https://en.wikipedia.org/wiki/NASCAR NASCAR racing cars]. It's a problem because such clusters of icons/brands cause both visual noise and people to be confused (see [https://en.wikipedia.org/wiki/Decision_theory#Paradox_of_choice Paradox of choice]), overwhelmed or unlikely to remember individual icons, especially as the clusters seem to grow with the introduction of new 3rd party identity/profile/social sites and services.
 ==Problems==
@@ Line 31: / Line 26: @@
 * The [[Web Site]] exposes its name in a manner that allows the user to make a meaningful trust decision. See the page on [[Trusted Identifier]] and [[Web Site Identity]] for details.
 * Most browsers come with a feature that will evaluate any file downloaded to a computer based on a set of constantly updated filters installed in the cloud.
 ===Security of Web Site Software===

@@ Line 32: / Line 32: @@
 * Most browsers come with a feature that will evaluate any file downloaded to a computer based on a set of constantly updated filters installed in the cloud.
-==Security of Web Site Software==
+===Security of Web Site Software===
 The question is, Why should a user trust a web site with their data.  None of the answers are easy.
 # [https://www.owasp.org/index.php/Main_Page The Open Web Application Security Project (OWASP)] is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of web site software.

@@ Line 25: / Line 25: @@
 * After 20 years of web based attacks on users, security protection is still dependent on the education of users, who are known to be gullible. This is a 2018-12 report from the NSS<ref>NSSlabs, ''NSS Labs Announces Results of 2018 Web Browser Security Test.'' (2018-12-05) https://globenewswire.com/news-release/2018/12/05/1662619/0/en/NSS-Labs-Announces-Results-of-2018-Web-Browser-Security-Test.html</ref>
 <blockquote>Education is a key component of protection against SEM [socially engineered malware] and phishing attacks. Users who are able to identify socially engineered attacks rely less on technology for protection against such attacks. NSS Labs recommends supplementing browser protection with user education to protect against attacks that bypass browser protections.</blockquote>
-* Secure Web Sites using SSL (HTTPS:// scheme) still allow insecure content to be loaded. On 2017-10-27 it was [https://github.com/mikewest/webappsec-mixed-content/blob/master/proposed-level-2-roadmap.md estimated that 2.4% of sites downloaded secure content]. On 2019-05-08 Chrome browser (currently version 74) was just announcing (on blink-dev) that they finally intend "to block insecurely-delivered downloads initiated from secure contexts if the download is for a high-risk file type", in spite of its appearance as section 4.6.5 of [https://html.spec.whatwg.org/#downloading-resources the current html spec.] Which asserts: '''Warning! This algorithm is intended to mitigate security dangers involved in downloading files from untrusted sites, and user agents are strongly urged to follow it.''' It is unclear which version of Chrome might have this feature.==Solutions==
+* Secure Web Sites using SSL (HTTPS:// scheme) still allow insecure content to be loaded. On 2017-10-27 it was [https://github.com/mikewest/webappsec-mixed-content/blob/master/proposed-level-2-roadmap.md estimated that 2.4% of sites downloaded secure content]. On 2019-05-08 Chrome browser (currently version 74) was just announcing (on blink-dev) that they finally intend "to block insecurely-delivered downloads initiated from secure contexts if the download is for a high-risk file type", in spite of its appearance as section 4.6.5 of [https://html.spec.whatwg.org/#downloading-resources the current html spec.] Which asserts: '''Warning! This algorithm is intended to mitigate security dangers involved in downloading files from untrusted sites, and user agents are strongly urged to follow it.''' It is unclear which version of Chrome might have this feature.
 The following are some ways to improve the situation and a subject to reality checks from time to time.
 * The [[Web Site]] exposes its name in a manner that allows the user to make a meaningful trust decision. See the page on [[Trusted Identifier]] and [[Web Site Identity]] for details.

@@ Line 33: / Line 33: @@
 The question is, Why should a user trust a web site with their data.  None of the answers are easy.
 # [https://www.owasp.org/index.php/Main_Page The Open Web Application Security Project (OWASP)] is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of web site software.
-# {https://www.gov.uk/government/news/government-sets-out-new-plans-to-help-build-trust-in-use-of-digital-identities UK Government sets out new plans to help build trust in use of digital identities] but what it seems to address is the trustworthiness of web sites with user data.
+# [https://www.gov.uk/government/news/government-sets-out-new-plans-to-help-build-trust-in-use-of-digital-identities UK Government sets out new plans to help build trust in use of digital identities] but what it seems to address is the trustworthiness of web sites with user data.
 ==References==

@@ Line 18: / Line 18: @@
 ==Protection of User Authenticators==
-Aka Credentials, is currently in development at
+Aka Credentials, is currently in development at:
 ==Problems==

← Older revision		Revision as of 00:31, 18 July 2020
Line 11:		Line 11:

	In the later case there is one existing solution, the [[Web Site]] can purchase an [[EV Cert]] for a modest fee that will guarantee some identity proofing of the business that owns the site. Some have pointed out that this proofing is inadequate, and federations of similar [[Enterprise]]s have banded together to create a central repository which will vouch for the site's [[Compliance]] with the [[Federation]]'s policies. For example the [https://wiki.shibboleth.net/confluence/display/CONCEPT/TrustManagement Trust Management] policies that are enabled with the SAML II [https://wiki.shibboleth.net/confluence/display/CONCEPT/Home Shibboleth Concepts]. This is further expanded on the wiki page [[Federated Trust]].		In the later case there is one existing solution, the [[Web Site]] can purchase an [[EV Cert]] for a modest fee that will guarantee some identity proofing of the business that owns the site. Some have pointed out that this proofing is inadequate, and federations of similar [[Enterprise]]s have banded together to create a central repository which will vouch for the site's [[Compliance]] with the [[Federation]]'s policies. For example the [https://wiki.shibboleth.net/confluence/display/CONCEPT/TrustManagement Trust Management] policies that are enabled with the SAML II [https://wiki.shibboleth.net/confluence/display/CONCEPT/Home Shibboleth Concepts]. This is further expanded on the wiki page [[Federated Trust]].
		+	* This page will only consider the use of a trusted [[User Agent]], typically a web browser from a well-known and trusted vendor.
		+	* For the case of the user allowing a [[Native App]] to be installed on their personal device, see the page [[Native App Security]].

	==User Experience==		==User Experience==