4 ms·

I clicked on this article looking to just scoff at some way for a CA to make money in the LetsEncrypt era, but I actually sort of agree with the idea of this. S

by atonse 9y ago

I clicked on this article looking to just scoff at some way for a CA to make money in the LetsEncrypt era, but I actually sort of agree with the idea of this. So much of security is about user behavior. "Secure" implies my password won't get stolen _ever_, not just "won't get stolen while I'm in this coffee shop but may be stored carelessly in plaintext by this vendor". Private would imply the latter more clearly, rather than the former.

jrimbault 9y ago
I did a poll for a my sociology class this year[0], I think people were confused between the ideas of what is "secure" and what is "private". In hindsight I should have put a quick definition of the two concepts at the top. It's particularly visible in the question about "to what degree do you agree with": "social networks are secure"/"bank websites are secure". People thought bank websites --which have notoriously bad password practices, for example mine (Société Générale) has a 6 digits password policy-- were more secure than social networks. Facebook and Twitter routinely enforce 2FA and multiple checks on each login attempt. Link but it's in French. [0]: https://docs.google.com/spreadsheets/d/1tGMDLGKVLfzqkkuCggzC_r1NhGEh1evh5KJTVKddYtE/edit?usp=sharing https://docs.google.com/spreadsheets/d/1tGMDLGKVLfzqkkuCggzC...
schoen 9y ago
I actually work on the Let's Encrypt project (though I'm speaking for myself here), and I have often said when forms of this issue have come up that I'm not sure what the right forms of security indication in browser UI should be. Obviously the Chrome people have been putting a lot of thought and research into this question. It seems like they would probably agree that there are significant challenges here and some fairly bad trade-offs. A simple form of that trade-off is that we don't want people to enter personal information or passwords on non-HTTPS sites, but we don't want them to think that a site being HTTPS means they don't have to care what site it is. We had someone on the Let's Encrypt forums complain that her site got hacked even though she used a Let's Encrypt certificate, which was supposed to make her site "secure". But I'm pretty confident that millions of site visitors experience exactly the same kinds of confusion about the meaning of the certificate, and don't regularly think about all the different dimensions of security here (including the confidentiality of your communications on the wire, the forward secrecy of your communications, the protection of your communications against tampering and content injection, the identity of the site operator, the intentions of the site operator, the data retention practices of the site operator, the data protection practices of the site operator, the jurisdictional exposures of the site operator, whether the site's infrastructure has been compromised, whether it will be compromised in the future, whether third parties can send you data through the site that harms you personally or that harms your devices...).
- x0x0 9y ago
  Overselling "Secure" to help lower people's defenses on a site like https://bank.com.fraudster.com https://bank.com.fraudster.com actively hurts. That button does not code to most people as "this site is merely who they say they are", rather than "this site is who I think they are". My MIL is unable to make that distinction and used to regularly get passwords stolen. The solution is to only use ios devices and rely on apples app curation. She doesn't do banking or anything else sensitive on her computer.
otakucode 9y ago
Well, until companies and executives can be charged with criminal negligence for refusing to follow either the advice of their own engineers or standard practices, its cheaper to let the data be stolen and deal with the fallout than it is to deal with building actual security, so you can presume off-hand that the information you provide is not going to be secure if it is retained by them. Assurance that your connection is not being intercepted and at least the transport is secure from your end to theirs, even if it gives no assurance of who they are, is at least a protection against nibshit spies like the NSA. (Until they convince ISPs to install BlueCoat boxes which wouldn't surprise me.)

by atonse 9y ago

jrimbault 9y ago

I did a poll for a my sociology class this year[0], I think people were confused between the ideas of what is "secure" and what is "private". In hindsight I should have put a quick definition of the two concepts at the top. It's particularly visible in the question about "to what degree do you agree with": "social networks are secure"/"bank websites are secure". People thought bank websites --which have notoriously bad password practices, for example mine (Société Générale) has a 6 digits password policy-- were more secure than social networks. Facebook and Twitter routinely enforce 2FA and multiple checks on each login attempt. Link but it's in French. [0]: https://docs.google.com/spreadsheets/d/1tGMDLGKVLfzqkkuCggzC_r1NhGEh1evh5KJTVKddYtE/edit?usp=sharing https://docs.google.com/spreadsheets/d/1tGMDLGKVLfzqkkuCggzC...

schoen 9y ago

I actually work on the Let's Encrypt project (though I'm speaking for myself here), and I have often said when forms of this issue have come up that I'm not sure what the right forms of security indication in browser UI should be. Obviously the Chrome people have been putting a lot of thought and research into this question. It seems like they would probably agree that there are significant challenges here and some fairly bad trade-offs. A simple form of that trade-off is that we don't want people to enter personal information or passwords on non-HTTPS sites, but we don't want them to think that a site being HTTPS means they don't have to care what site it is. We had someone on the Let's Encrypt forums complain that her site got hacked even though she used a Let's Encrypt certificate, which was supposed to make her site "secure". But I'm pretty confident that millions of site visitors experience exactly the same kinds of confusion about the meaning of the certificate, and don't regularly think about all the different dimensions of security here (including the confidentiality of your communications on the wire, the forward secrecy of your communications, the protection of your communications against tampering and content injection, the identity of the site operator, the intentions of the site operator, the data retention practices of the site operator, the data protection practices of the site operator, the jurisdictional exposures of the site operator, whether the site's infrastructure has been compromised, whether it will be compromised in the future, whether third parties can send you data through the site that harms you personally or that harms your devices...).

x0x0 9y ago
Overselling "Secure" to help lower people's defenses on a site like https://bank.com.fraudster.com https://bank.com.fraudster.com actively hurts. That button does not code to most people as "this site is merely who they say they are", rather than "this site is who I think they are". My MIL is unable to make that distinction and used to regularly get passwords stolen. The solution is to only use ios devices and rely on apples app curation. She doesn't do banking or anything else sensitive on her computer.

otakucode 9y ago

Well, until companies and executives can be charged with criminal negligence for refusing to follow either the advice of their own engineers or standard practices, its cheaper to let the data be stolen and deal with the fallout than it is to deal with building actual security, so you can presume off-hand that the information you provide is not going to be secure if it is retained by them. Assurance that your connection is not being intercepted and at least the transport is secure from your end to theirs, even if it gives no assurance of who they are, is at least a protection against nibshit spies like the NSA. (Until they convince ISPs to install BlueCoat boxes which wouldn't surprise me.)