Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-30 Thread n...@cock.li
I came across this thread from the weekly news post for this week, so please excuse me if I've missed some from just skimming through the posts. Having randomart/gravatars/poems/etc seems like a rather interesting topic, but seriously adding it to tor, there seems to be a few problems in my mind:

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-26 Thread Ben Laurie
On Thu, 20 Aug 2015 at 14:49 George Kadianakis wrote: > > Then there are even more crazy ideas like the "Dynamic Security Skins" > paper [1]. So for example, TBB could generate a unique UI theme for each > hidden service. > Unfortunately, I can no longer find it, but I have seen research t

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-21 Thread R. Anthony Lomartire
I like the idea of a drop down notification type deal that displays that you have not visited this site before. And implement that as a default off option in TBB. This lets the user decide if they accept that tradeoff. On Fri, Aug 21, 2015 at 5:11 PM Tom Ritter wrote: > On 20 August 2015 at 09:2

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-21 Thread Tom Ritter
On 20 August 2015 at 09:24, Jeff Burdges wrote: > > I first learned about key poems here : > https://moderncrypto.org/mail-archive/messaging/2014/000125.html > If one wanted a more language agnostic system, then one could use a > sequence of icons, but that's probably larger than doing a handful o

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-21 Thread Georg Koppen
Yawning Angel: > As much as all of these are important issues, if we search for a > solution that works for absolutely everyone, then we will never > implement anything, because IMO no such thing exists. > > I sort of have mixed feelings about this in general, but since enough > people seem to thi

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Jeff Burdges
A per browser salt is a wonderful idea. It's basically impossible to fake even small key poems or whatever if you cannot guess their salt. Just some thoughts : - The salt should be a text field users can interact with easily. It could be displayed prominently in the extensions config, or eve

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Yawning Angel
On Fri, 21 Aug 2015 04:39:14 +1000 teor wrote: [snip] > Visual schemes are only helpful to users who have the appropriate > level of visual ability or processing: > * as has already been mentioned, colouring schemes are not as useful > to the colourblind; > * facial recognition schemes are useles

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread teor
> On 21 Aug 2015, at 02:56, Jesse V wrote: > > >> Jacek Wielemborek writes: >> >>> George Kadianakis pisze: Some real UX research needs to be done here, before we decide something terrible. >>> >>> Just curious, has anybody seen any cognitive studies on the SSH >>> randomart visua

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Jesse V
> Jacek Wielemborek writes: > >> George Kadianakis pisze: >>> Some real UX research needs to be done here, before we decide something >>> terrible. >> >> Just curious, has anybody seen any cognitive studies on the SSH >> randomart visualisation? I always found them impossible to remember. >> Per

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Yawning Angel
On Thu, 20 Aug 2015 11:00:51 -0400 Ian Goldberg wrote: > On Thu, Aug 20, 2015 at 02:41:51PM +, Yawning Angel wrote: > > What would be useful here is the number of onion addresses an > > average user visits. If it's small, something like this would > > probably be sufficient: > > > > 0. Bro

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Adam Shostack
On Thu, Aug 20, 2015 at 11:00:51AM -0400, Ian Goldberg wrote: | I'd caution about the poker hand, though. One year when I taught | first-year undergraduate CS, we included an assignment that had to do | with decks of cards and card games. A surprising number of people had | never seen decks of ca

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Ian Goldberg
On Thu, Aug 20, 2015 at 02:41:51PM +, Yawning Angel wrote: > What would be useful here is the number of onion addresses an average > user visits. If it's small, something like this would probably be > sufficient: > > 0. Browser generates/stores a long term salt. > > 1. On onion access, cal

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Yawning Angel
On Thu, 20 Aug 2015 17:02:24 +0300 George Kadianakis wrote: > Jacek Wielemborek writes: > > > W dniu 20.08.2015 o 15:49, George Kadianakis pisze: > >> Some real UX research needs to be done here, before we decide > >> something terrible. > > > > Just curious, has anybody seen any cognitive st

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Jeff Burdges
I first learned about key poems here : https://moderncrypto.org/mail-archive/messaging/2014/000125.html If one wanted a more language agnostic system, then one could use a sequence of icons, but that's probably larger than doing a handful of languages. I once encountered an article claiming that

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread George Kadianakis
Jacek Wielemborek writes: > W dniu 20.08.2015 o 15:49, George Kadianakis pisze: >> Some real UX research needs to be done here, before we decide something >> terrible. > > Just curious, has anybody seen any cognitive studies on the SSH > randomart visualisation? I always found them impossible

Re: [tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread Jacek Wielemborek
W dniu 20.08.2015 o 15:49, George Kadianakis pisze: > Some real UX research needs to be done here, before we decide something > terrible. Just curious, has anybody seen any cognitive studies on the SSH randomart visualisation? I always found them impossible to remember. Perhaps adding a bit mor

[tor-dev] Hash Visualizations to Protect Against Onion Phishing

2015-08-20 Thread George Kadianakis
Hello, this mail lays down an idea for a TBB UI feature that will make it slightly harder to launch phishing attacks against hidden services. The idea is based on hash visualizations like randomart [0] and key poems: --- | o=. |