Enigma 2019

Browsers are the window that the user has onto the ever-expanding web, with the good, the bad, and the ugly that it contains. Security mechanism design on the web has traditionally relied on the user to make rational, carefully-considered choices. Too often this become a barrage of prompts and dialogues, which end-users ultimately tend to ignore.

In this talk, we highlight the fact that this assumption is based on flimsy science at best, and, at worst, completely debunked. We therefore argue that the browser should do more to help the user with these decision, thereby truly stepping into the shoes of a user agent. While there may be decisions the user has to make, they must be less frequent and asked in a way where the user has a reasonable basis for making a well-informed decision. For example, a prompt to switch the browser into private browsing mode or to block all 3rd party cookies on a given site, due to the nature of the content they’re browsing may be accompanied with a side-by-side before-and-after picture.