6 ms·

I think it's safe to assume HTTPS when it comes to browser indications is broken. In a sense that majority of user don't care or understand. I once had a clien

I think it's safe to assume HTTPS when it comes to browser indications is broken. In a sense that majority of user don't care or understand. I once had a client who wanted an EV cert, so the company name gets "shown nicely in the address bar". After explaining about encryption for half an hour, the only question was why should I care. It was a simple website for a company. Contacts and about us mainly. I often ask regular users, and they don't know what difference does it make, the click everything and as far as they care, the lock can even be purple. Which doesn't mean we shouldn't keep pushing https mainstream of course. Correct me if I'm wrong.

kevhito 11y ago
Why would you do that? Did you also try to explain the beauty of diffie hellman key exchange and the details of TCP selective acknowledgement before helping your client get an EV cert?
Flimm 11y ago
Get a Wifi Pineapple device and show them how easy it is to do a MITM attack. A demonstration might make them care.
seanwilson 11y ago
> I think it's safe to assume HTTPS when it comes to browser indications is broken. In a sense that majority of user don't care or understand. I'd agree with this as well. I find summarising it as "if you enter secret details when the green lock isn't there, a hacker could steal them" isn't concrete enough to sink in for most non-technical users. To really understand what the HTTPS lock icon means let alone what mixed content warnings means requires a lot of background knowledge most of us take for granted (web servers, networking, hacking, how a web page loads scripts/images/css). Given many people still use simple passwords and the same passwords everywhere because of lack of understanding of what hackers can do, I think it's a lost cause. People do pay attention to e.g. Chrome's big red "this site is not secure" screen that you have to bypass when there's something wrong with the SSL certificate though. Showing something like this as standard would help.
- _asummers 11y ago
  I managed to get my mother to use a password manager. I did my due diligence in explaining the security aspects, as far as "well if someone gets your Facebook password, how likely is that to be your Gmail password" , but mostly had to frame it as a convenience feature of being able to use all these complicated passwords without having to remember any of them.
  - seanwilson 11y ago
    I've lost count of how often I've heard friends and family say things like "well there's nothing important in my computer/email/Facebook anyway". I try to explain about how hackers can use credentials to eventually get into their bank accounts, steal their identity, use their computer in botnet and spam schemes etc. but it usually comes across as farfetched for some reason. I'm sure it sinks in when they or someone they know is directly impacted by a hacker but I think the problem is this doesn't happen often enough.
    - avian 11y ago
      I think the part that is hard to grasp for people without a technical background is the danger of automated attacks. It's hard to explain that even if nobody is interested specifically in their computer/email/Facebook, they can still be a victim of a dragnet kind of an effort.
      - seanwilson 11y ago
        Yeah, I struggle to think of any good analogy that would help explain the problem. You could explain HTTP as like sending a postal letter where an attacker can intercept and read the letter undetected, reply back as if they were the receiver etc . but that's already pretty abstract. Drawing a real-world analogy with automated password attacks seems even harder.
        dsp1234 11y ago
        "There's a gang around here that like to walk up to every car in the parking lot and try every door. They aren't targeting you specifically, they just try every door knowing that some doors will be unlocked. So always lock your doors"
rplnt 11y ago
> why should I care. It was a simple website for a company I wouldn't want some shady ISP or a public hotspot injecting ads (or worse) into my company site.
- angry-hacker 11y ago
  Neither do I and I care about encryption. What I wanted to tell is that even after explaining, the person in question just wanted "that green lock with company name". That's it.
Someone1234 11y ago
> I once had a client who wanted an EV cert, so the company name gets "shown nicely in the address bar". After explaining about encryption for half an hour, the only question was why should I care. It was a simple website for a company. Contacts and about us mainly. What does encryption have to do with EV specifically? And why did you care? I'd happily help a business client get an EV certificate for conducting business, that's exactly why they exist.

kevhito 11y ago

Why would you do that? Did you also try to explain the beauty of diffie hellman key exchange and the details of TCP selective acknowledgement before helping your client get an EV cert?

Flimm 11y ago

Get a Wifi Pineapple device and show them how easy it is to do a MITM attack. A demonstration might make them care.

seanwilson 11y ago

> I think it's safe to assume HTTPS when it comes to browser indications is broken. In a sense that majority of user don't care or understand. I'd agree with this as well. I find summarising it as "if you enter secret details when the green lock isn't there, a hacker could steal them" isn't concrete enough to sink in for most non-technical users. To really understand what the HTTPS lock icon means let alone what mixed content warnings means requires a lot of background knowledge most of us take for granted (web servers, networking, hacking, how a web page loads scripts/images/css). Given many people still use simple passwords and the same passwords everywhere because of lack of understanding of what hackers can do, I think it's a lost cause. People do pay attention to e.g. Chrome's big red "this site is not secure" screen that you have to bypass when there's something wrong with the SSL certificate though. Showing something like this as standard would help.

_asummers 11y ago
I managed to get my mother to use a password manager. I did my due diligence in explaining the security aspects, as far as "well if someone gets your Facebook password, how likely is that to be your Gmail password" , but mostly had to frame it as a convenience feature of being able to use all these complicated passwords without having to remember any of them.
- seanwilson 11y ago
  I've lost count of how often I've heard friends and family say things like "well there's nothing important in my computer/email/Facebook anyway". I try to explain about how hackers can use credentials to eventually get into their bank accounts, steal their identity, use their computer in botnet and spam schemes etc. but it usually comes across as farfetched for some reason. I'm sure it sinks in when they or someone they know is directly impacted by a hacker but I think the problem is this doesn't happen often enough.
  - avian 11y ago
    I think the part that is hard to grasp for people without a technical background is the danger of automated attacks. It's hard to explain that even if nobody is interested specifically in their computer/email/Facebook, they can still be a victim of a dragnet kind of an effort.
    - seanwilson 11y ago
      Yeah, I struggle to think of any good analogy that would help explain the problem. You could explain HTTP as like sending a postal letter where an attacker can intercept and read the letter undetected, reply back as if they were the receiver etc . but that's already pretty abstract. Drawing a real-world analogy with automated password attacks seems even harder.
      - dsp1234 11y ago
        "There's a gang around here that like to walk up to every car in the parking lot and try every door. They aren't targeting you specifically, they just try every door knowing that some doors will be unlocked. So always lock your doors"

rplnt 11y ago

> why should I care. It was a simple website for a company I wouldn't want some shady ISP or a public hotspot injecting ads (or worse) into my company site.

angry-hacker 11y ago
Neither do I and I care about encryption. What I wanted to tell is that even after explaining, the person in question just wanted "that green lock with company name". That's it.

Someone1234 11y ago

> I once had a client who wanted an EV cert, so the company name gets "shown nicely in the address bar". After explaining about encryption for half an hour, the only question was why should I care. It was a simple website for a company. Contacts and about us mainly. What does encryption have to do with EV specifically? And why did you care? I'd happily help a business client get an EV certificate for conducting business, that's exactly why they exist.