Schneier on Security

Duncan • March 17, 2017 11:07 AM

The big general problem here is that browsers don’t make it easy for users to know which entity they are communicating with. Just try making up a message to send to your friends and family to tell them how to avoid falling for this attack (which I just did). Sure, you can tell them not to click on attachments – but that’s not useful – you might as well tell them not to use the internet at all. No, you have to tell them to look at the address bar (if they even know what that is), make sure it begins with https:// (which probably has their eyes glazing over already), make sure it doesn’t have anything in front of the https, and on and on. Really impossible, in other words, for the average user to know what to look for.

I have an idea that I think would really help, as follows: Every browser should display, in a prominent location that’s clearly separate from the page being viewed, exactly WHO the user is communicating with. I’m not talking about a domain name here, I’m talking about a plain language name of the organization, so the user knows, that they are sending information to “Google, inc.” or “The Alaska state government”, or “Boeing Employees Credit Union (BECU)”, or “Fred’s Online Shopping, Inc.”. This would require that the certificates used in HTTPS contain useful information about the organization to whom the certificate has actually been issued. Ideally, there would be much stronger vetting involved when these certificates are issued, and measures to prevent people from getting certificates with identities intended to trick people, like “gooogle”, and so on. For http connections the browser should display a message telling the user that he/she could be talking to anyone.

Some browsers are sort of moving in this direction. For examplem, safari on mobile devices doesn’t display the address at all, it just displays the domain name and a little lock icon. I think for most users that’s an improvement, although personally I’d rather be able to see the actual full URL I am visiting. But still, this is displaying DNS information, which isn’t what users really need to know – they need to know the identity of the organization that owns the page they are communicating with, and that identity should be given the way humans normally identify organizations – in other words the organization or individual’s proper name.

Duncan • March 17, 2017 11:59 AM

Daniel wrote: “…Technology cannot cure opsec fails.”

Maybe true. But Technology can certainly make it more or less likely for opsec fails to occur.

I read somewhere that the majority of baby car seats are not secured properly, and in the event of a crash the seat would go flying around inside the car. How do you interpret this? Parents need to be much more careful and do a better job of securing baby seats. Well, yes. But that’s not what I would think of first. I would immediately think that car seat manufacturers and car manufacturers need to do a much better job of making it easy to attach baby seats, and completely obviouis when they are attached wrong.

I still maintain that telling people not to click on attachments is useless advice. The fact is that it’s extremely useful to be able to send and receive attachments in email. I’ve downloaded half a dozen attachments from email in the past hour (receipts from a recent trip). Telling people not to download attachments would be like telling parents just not to take their baby with them in the car, because it’s too hard to be sure the baby seat is properly attached.

No, it’s too easy to blame the failure on the users, but that’s not where the blame should be assigned.

Duncan • March 17, 2017 6:14 PM

@Daniel wrote: Here’s the opsec rule: Never enter your login credentials into a website whose URL you did not type into the browser yourself.

I guess we are going to have to agree to disagree. I mean, I agree that’s a valid opsec rule. I just don’t agree that it’s any way realistic, or even reasonable, to expect most users to follow that rule. Let me ask you this: Do your mom and dad follow that rule? Your kids? Your grandma and grandpa? Many users probably NEVER type URLs into the browser bar – everything they do is driven by clicking links, bookmarks, etc… Heck, I would bet that only a minority of readers of this forum follow that rule 100% of the time.

Another area where we may have to agree to disagree is: whose responsibility it is to provide security? Sure, users have to take some responsibility. But software vendors can, and should, make it much easier for the average user to achieve security. I would argue that, right now, it’s pretty much impossible for the average user to use the tools they are offered (email, social media, etc.) in a secure way. If “real world” products were as difficult to use, and as likely to cause harm, as most of the software we use, there would be a LOT of product liability lawsuits. If I bought a door lock that was advertised as secure, but was made in such a way that it looked like it was locked when in fact it was unlocked, and my house got broken into, I think I might have a good case for a lawsuit.

Anyway, regardless, can we agree that more could be done, and should be done, to make it easier for users to be secure? Any comment on my idea that the browser should make it much clearer to the user exactly WHO they are communicating with, without expecting the user to understand the structure of URLs?

Duncan