Hacker News Reader

Comment by brohoolio | Hacker News Reader

I appreciate Google being aggressive in this front, but they've trained people, like my mom, to ignore the little green lock in the last 6 months.

View on HN

It's worse than that. They've trained users to ignore the RED "X" on the little lock and the RED strikethrough on the "https" that Chrome shows for sites with SHA1-signed certs that expire after 2016[1]. Reasonable or not, some sites can't or won't update their certs and have no choice but to tell Chrome users to ignore those warnings.

[1] http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...

You don't have to ignore the warning. It means that what you see on the site might have been recorded or modified in transit, and what you type in might be recorded or modified on the way back to the server. You might decide that it's fine for browsing but decline to put in personal information on those sites. It's up to you.

The problem is that outside of our niche of people who really care about tech, most people just care about the contents of the webpages they visit. They aren't reading/understanding the warning and have no context for making that assessment of safety and responding appropriately. They just know that they want to go to their bank's site or play the latest Mafiaville or whatever.

These changes in Chrome are teaching them that the red marks on the location bar are just a normal part of those interactions.

Yeah, I don't think my Mom is going to be able to make the decision.

The biggest problem is that security is not a boolean, and yet we've conditioned users to think that it is. Instead of educating them on the different types and levels of security, we're giving them a black-and-white assessment. This makes it harder for them to make an informed decision.

Expecting people to get training to have a nuanced reaction to symbols used in security is a lost cause for web browsing. The mystique of the web is long gone. Its an every person thing now and reduced to binary decisions.

Web browser developers need to make some decisions to make clear what is safe, probably safe, and an threat. Lumping wrong, but probably safe things in with threats means that users will ignore threats. Look at the history of Windows and users just clicking dialogue boxes without reading.

Do you have any sources showing that the incidence of ignoring SSL warnings has increased?

It has always been a joke of a feature. If it's dangerous; block the website. If not; display it to the user.

Normal users don't want to deal with the technicalities. Presenting information to the user is just a way to "do something" while not actually taking responsibility and solving the problem.

How can you ever know what is dangerous or not for the user to do? Get some humility.

That's exactly the mindset that put us in this horrible situation. People would start warning against bad crypto much sooner if the consequences weren't as bad as browsers made them. We could even have warnings against plain HTTP already if browser security wasn't this radical.

Umm, 'danger' is not binary. There is no hard and fast rule that makes something 'dangerous'. There are levels of danger, and levels of risk. How can a browser know where that line is for every user and every site?

I think the idea that end users will avoid MITM attacks is just never going to happen, if it ever did. All this hair-splitting over SSL has long ruined this, which is a shame because that's the most common attack an end user will have. Worry that $nation_state_intel_services might someday crack your SSL session is a bit much. Google is a company run by, lets face it, paranoid web devs. In their minds, a potentially weak SSL cipher is just as bad as a MITM attack. I think the reasoning is foolish, personally, and we're in a period where Google's web dev mentality rules the security roost. Focusing on trivial SSL issues really isn't making us more secure. If anything, its training users to be baffled and potentially less secure because they don't understand why all the random yellow and red x's mean, especially on trusted sites like their employer's site.

Reply on news.ycombinator.com