4 ms·
It's tricky: how is a user supposed to distinguish between "this site doesn't support HTTPS at all" and "a MitM is making the HTTPS site slow so I give up and u
by jacobparker 10y ago
It's tricky: how is a user supposed to distinguish between "this site doesn't support HTTPS at all" and "a MitM is making the HTTPS site slow so I give up and use the HTTP version"?
What if it's their bank and they really need to pay a bill right now? Maybe the HTTPS site is just broken right now.
Users aren't wrong for clicking yes through these dialogs. This kind of UX is setting them up for failure with impossible choices. Its even worse in practice: users (including programmers, as evidenced by the comments in every HN thread about HTTPS) won't understand everything that's in play before making this decision. Assume users always click yes.
HSTS, preloading and restricting new features to HTTPS etc. are ultimately working to deprecate non-HTTP (inside browsers).
- rythie 10y agoMost of what you are saying makes sense, except this bit: > "Maybe the HTTPS site is just broken right now." In the case of a bank, it's extremely unlikely that they are falling back to HTTP. It's much more likely that sslstrip is in place if you had this. The cost and hassle of someone having access to your whole bank account, is likely much higher than the fines for a late payment.
- jacobparker 10y agoI get that, but I most users don't.