Hacker News Reader

Comment by bm98 | Hacker News Reader

It's worse than that. They've trained users to ignore the RED "X" on the little lock and the RED strikethrough on the "https" that Chrome shows for sites with SHA1-signed certs that expire after 2016[1]. Reasonable or not, some sites can't or won't update their certs and have no choice but to tell Chrome users to ignore those warnings.

[1] http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...

View on HN

The biggest problem is that security is not a boolean, and yet we've conditioned users to think that it is. Instead of educating them on the different types and levels of security, we're giving them a black-and-white assessment. This makes it harder for them to make an informed decision.

Expecting people to get training to have a nuanced reaction to symbols used in security is a lost cause for web browsing. The mystique of the web is long gone. Its an every person thing now and reduced to binary decisions.

Web browser developers need to make some decisions to make clear what is safe, probably safe, and an threat. Lumping wrong, but probably safe things in with threats means that users will ignore threats. Look at the history of Windows and users just clicking dialogue boxes without reading.

You don't have to ignore the warning. It means that what you see on the site might have been recorded or modified in transit, and what you type in might be recorded or modified on the way back to the server. You might decide that it's fine for browsing but decline to put in personal information on those sites. It's up to you.

The problem is that outside of our niche of people who really care about tech, most people just care about the contents of the webpages they visit. They aren't reading/understanding the warning and have no context for making that assessment of safety and responding appropriately. They just know that they want to go to their bank's site or play the latest Mafiaville or whatever.

These changes in Chrome are teaching them that the red marks on the location bar are just a normal part of those interactions.

Yeah, I don't think my Mom is going to be able to make the decision.

Do you have any sources showing that the incidence of ignoring SSL warnings has increased?

Reply on news.ycombinator.com