Re: [TLS] the use cases for GSS-based TLS and the plea for integrating

[pgut001 at cs.auckland.ac.nz]

Jeffrey Altman <jaltman at secure-endpoints.com> writes:
> Martin Rex wrote:
> > If Public Key technology was more along the line of the original
> > models of SSH and PGP, it would likely be used much more often.
> You might want to read Alma Whitten's paper "Why Johnny Can't
> Encrypt?".  Its a usability study that explains why PGP is not usable
> for common folks.

If required I can add a shopping-list of other usability studies looking at
why PKI in general is not usable for common folks.  There's a summary in the
slides at http://www.cs.auckland.ac.nz/~pgut001/pubs/phishing.pdf, and a
really long analysis (100-odd pages total, although it covers lots of other
areas as well) at
http://www.cs.auckland.ac.nz/~pgut001/pubs/man_usability.pdf.

(Note that I'm not saying ditch PKI-based auth altogether, keep it if you
want, but don't insist on making it a mandatory option in TLS if it doesn't
work to protect users).

Peter.


_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls