3 ms·
The real snag is the way that SSL/TLS is marketed. In the post is a link to a belting tweet by a Scott Hanselman: "HTTPS & SSL doesn't mean "trust this." It m
by gerdesj 9y ago
The real snag is the way that SSL/TLS is marketed. In the post is a link to a belting tweet by a Scott Hanselman:
"HTTPS & SSL doesn't mean "trust this." It means "this is private." You may be having a private conversation with Satan."
TLS (nee SSL) was conceived a long time ago (it's about a 10th of the age of my house but in internet terms a good while back) and is now ubiquitous. The trouble is that end users int al. do not really understand what it really means.
It really doesn't help that Chrome/Chromium and Firefox at least are making it harder and harder to actually view a SSL cert from a website. The Google mob are making it almost bloody impossible for those not familiar with dev tools - rubbish.
- ploxiln 9y agoI think the real take-away here is that there is just no substitute for looking at the URL bar to see the domain. HTTPS means that the url bar is not lying, but you still have to look there and see if it's the correct entity. EV certs are more of the same - you still have to look up at that URL bar and see the organization name. All of us who know how to trust websites, do it by looking at the domain. We don't remember what sites have an EV cert. It doesn't matter, the standard procedure always works: check https, check domain, done. No other solution works reliably, at the scale of the web. Any other solution ends up adding complication. Doing this the right way really isn't hard, people just need one half-hour class, in their entire life, to enable them to reasonably safely use the web.