Achieving Email Security Usability PowerPoint Presentation

Slide 1 -

Achieving Email Security Usability Phillip Hallam-Baker Principal Scientist VeriSign Inc. Luxury

Slide 2 -

2 Cars

Slide 3 -

3 Usability is not enough

Slide 4 -

4 Luxury

Slide 5 -

5 (A Stretch Goal)

Slide 6 -

6 Is Luxury Possible?

Slide 7 -

7 An Existence Proof

Slide 8 -

8 Video Game: A User Experience so good people will pay to use it

Slide 9 -

9 Security Goal: Protect assets against risks

Slide 10 -

10 Security Goal: Protect assets against risks

Slide 11 -

11 The real end point

Slide 12 -

12 Plenty of Technology

Slide 13 -

13 Selection not creation DKIM X.509 Logotype XKMS PGP + S/MIME PKIX* OCSP* SCVP X.500 SAML WS-Trust

Slide 14 -

14 Cost of Change Endpoints $$$$$ Network $$ Internet $$$$

Slide 15 -

15 Luxury Requirement #1 Respect me.

Slide 16 -

16 I don’t want to be you Users do not aspire to be computer experts Don’t try to change me. GED/J d-- s:++>: a-- C++(++++) ULU++ P+ L++ E---- W+(-) N+++ o+ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++ e++ h r-- y++**

Slide 17 -

17 Education, not Training Education is empowerment Training is mere instruction

Slide 18 -

18 Luxury Requirement #2 Anticipate my needs

Slide 19 -

19 Declarative, not imperative “The rooms to be commodious”

Slide 20 -

20 Luxury Requirement #3 Clear Use Model

Slide 21 -

21 Domain Centric Security Security policy set at the domain level

Slide 22 -

22 User choice? Buy a domain name, they cost $8/yr

Slide 23 -

23 Owning the domain name is a security issue

Slide 24 -

24 Luxury Requirement #4 Eliminate the unnecessary

Slide 25 -

25

Slide 26 -

26

Slide 27 -

27 Luxury Requirement #5 Provide the necessary and the desirable

Slide 28 -

28 What is necessary? Where did this message really come from?

Slide 29 -

29 Luxury Requirement #6 Please me

Slide 30 -

30 Demonstration

Slide 31 -

31 How

Slide 32 -

32 DKIM In IETF Process

Slide 33 -

33 DKIM Sign messages transparently

Slide 34 -

34 Secure Internet Letterhead User-friendly name for LOGOTYPE extension IETF Proposed Standard

Slide 35 -

35 Secure Internet Letterhead Add X.509 Certificate to DKIM Key Record

Slide 36 -

36 PGP, S/MIME IETF Draft standards

Slide 37 -

37 PGP, S/MIME Encryption works fine Need key discovery

Slide 38 -

38 XKMS W3C Recommendation

Slide 39 -

39 XKMS Key centric PKI

Slide 40 -

40 XKMS Register end user keys

Slide 41 -

41 XKMS Key discovery

Slide 42 -

42 XKMS Connect COTS client to extreme PKI

Slide 43 -

43 Summary

Slide 44 -

44 Deployment cost ~10,000 Lines of code

Slide 45 -

45 Accountability

Slide 46 -

46 Accountable Email Authentication Accreditation Consequences

Slide 47 -

47 Accountability for all

Slide 48 -

48 Conclusion Our achievements are only limited by our aspirations

Slide 49 -

Thank You Questions