3 ms·

Sorry, I know it was well-meaning, but it's riddled with "technical crap" and assumed knowledge which make it hard to decide upon. Not least a pretty foreign us

Sorry, I know it was well-meaning, but it's riddled with "technical crap" and assumed knowledge which make it hard to decide upon. Not least a pretty foreign uses of "trust" and "certification" for non-technical people. E.g.: 1. "Certified by" — what does this mean? Is like a rating thing? A tripadvisor thing for the web? 2. "X" who are they? Do they want my money? Do I need a new one? 3. "Current trusted certifier" oh god, did I choose them? Are they bad now? Did I not pay them money? Has it been hacked? Didn't it do a review of BigWebsite yet maybe? I could just wait I guess. 4. There are three buttons that say "yes"! If I hit "always" what if it was wrong? And "if Google verifies" well that's obviously a scam because my web is Google so it would already know. This is all some kind of scam. I'm out of here.

mehrdadn 9y ago
I edited it. Is this better? I honestly don't see why the concept of "This site claims to be WorldBank.com, but we can't verify this. Whom do you trust enough to ask?" requires technical knowledge of any kind. People already understand this is why they have ID cards and background checks -- "I don't know if I can trust this guy; do you trust X to run a background check (or ask him to show an ID card issued by Y)?" is the same exact concept. Why do you think ordinary people fundamentally cannot understand this on the computer when they already understand it (and much more difficult things) just fine in real life? Also, don't forget that none of this applies to when you choose the default settings. This is only if you choose to distrust some organizations.
- vertex-four 9y ago
  Most people, funnily enough, don't run background checks on other people, and don't have a well-formed mental model of why they're necessary and what the security risks in using them are.
  - mehrdadn 9y ago
    > Most people, funnily enough, don't run background checks on other people They don't do it because they're not employers/landlords/etc. and hence the need never arises, not because they somehow have a complete lack of understanding of the concept. > and don't have a well-formed mental model of why they're necessary and what the security risks in using them are They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. They understand what a fake ID or passport is, and they understand why they shouldn't give their ID numbers to random strangers. The specific examples I used are not the point. I explicitly said they're not perfect; they're just there to get a bigger point across. Look at the larger point. The point is people are already dealing with much more complicated stuff on a daily basis. They understand the concept of lying. They understand that identity theft can wreak havoc on their lives. They understand how to prevent it. So they can handle the concept of what it means to enter their credentials on the wrong site. It's not technical and it's not complicated, and it's not necessary for them to understand how exactly doing the wrong thing might lead to an undesirable result. If you'd like to convince me that the average person can't understand this concept, at least support your claim by providing a link to a study or something that isn't based on a cherry-picked strawman version of what I've suggested? Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation?
    - icebraining 9y ago
      The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it.
      - mehrdadn 9y ago
        > The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it. But I'm only saying the current UX could become much better, not that they have to switch to my suggested UI by tomorrow. Of course spending some time on user education and transitioning gradually would be a great idea. I was never against that; I'm all for it. So why implicitly rule this out as an impossibility?
    - vertex-four 9y ago
      > They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. Not in my experience - people reuse passwords regularly, and are exceptionally vulnerable to phishing scams, as you should ask anybody working in corporate IT. This is why people actually working in security are very excited about U2F - a U2F-generated token is tied to a specific domain, so password reuse and phishing are both no longer as serious a problem, since a login to scammer.com no longer works as a login to mybank.com. On top of that, people give their bank passwords to e.g. mint.com on a regular basis, when it's specifically asking for their bank password and they have no reason to trust that website. > they understand why they shouldn't give their ID numbers to random strangers Also not in my experience, and the basis of many scams. People at large are terrible at security. We've been moving towards "automatic security" for a while for a reason. And that's before you get to the phenomena where critical thinking goes out the window as soon as something is on a computer instead of "in real life". > Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation? Moxie Marlinspike's Convergence would be the closest thing, iirc. Whenever you access example.com, you ask a handful of user-selected notary servers to access example.com and tell you its TLS cert. If all of them match, you're not being MITMed. You don't have to trust any individual notary server, because it's all of them put together that provide the trust. Of course, trying to figure out a good UX for "my Government and Google say it's fine, but Estonia and Facebook say it's not" in such a way that users aren't going to be severely inconvenienced by a malfunctioning/MITMed notary server but also aren't going to click on "I have no idea what this is just let me see the website" on a MITMed page is hard - probably impossible. Moxie has since given up on it.

mehrdadn 9y ago

I edited it. Is this better? I honestly don't see why the concept of "This site claims to be WorldBank.com, but we can't verify this. Whom do you trust enough to ask?" requires technical knowledge of any kind. People already understand this is why they have ID cards and background checks -- "I don't know if I can trust this guy; do you trust X to run a background check (or ask him to show an ID card issued by Y)?" is the same exact concept. Why do you think ordinary people fundamentally cannot understand this on the computer when they already understand it (and much more difficult things) just fine in real life? Also, don't forget that none of this applies to when you choose the default settings. This is only if you choose to distrust some organizations.

vertex-four 9y ago
Most people, funnily enough, don't run background checks on other people, and don't have a well-formed mental model of why they're necessary and what the security risks in using them are.
- mehrdadn 9y ago
  > Most people, funnily enough, don't run background checks on other people They don't do it because they're not employers/landlords/etc. and hence the need never arises, not because they somehow have a complete lack of understanding of the concept. > and don't have a well-formed mental model of why they're necessary and what the security risks in using them are They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. They understand what a fake ID or passport is, and they understand why they shouldn't give their ID numbers to random strangers. The specific examples I used are not the point. I explicitly said they're not perfect; they're just there to get a bigger point across. Look at the larger point. The point is people are already dealing with much more complicated stuff on a daily basis. They understand the concept of lying. They understand that identity theft can wreak havoc on their lives. They understand how to prevent it. So they can handle the concept of what it means to enter their credentials on the wrong site. It's not technical and it's not complicated, and it's not necessary for them to understand how exactly doing the wrong thing might lead to an undesirable result. If you'd like to convince me that the average person can't understand this concept, at least support your claim by providing a link to a study or something that isn't based on a cherry-picked strawman version of what I've suggested? Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation?
  - icebraining 9y ago
    The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it.
    - mehrdadn 9y ago
      > The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it. But I'm only saying the current UX could become much better, not that they have to switch to my suggested UI by tomorrow. Of course spending some time on user education and transitioning gradually would be a great idea. I was never against that; I'm all for it. So why implicitly rule this out as an impossibility?
  - vertex-four 9y ago
    > They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. Not in my experience - people reuse passwords regularly, and are exceptionally vulnerable to phishing scams, as you should ask anybody working in corporate IT. This is why people actually working in security are very excited about U2F - a U2F-generated token is tied to a specific domain, so password reuse and phishing are both no longer as serious a problem, since a login to scammer.com no longer works as a login to mybank.com. On top of that, people give their bank passwords to e.g. mint.com on a regular basis, when it's specifically asking for their bank password and they have no reason to trust that website. > they understand why they shouldn't give their ID numbers to random strangers Also not in my experience, and the basis of many scams. People at large are terrible at security. We've been moving towards "automatic security" for a while for a reason. And that's before you get to the phenomena where critical thinking goes out the window as soon as something is on a computer instead of "in real life". > Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation? Moxie Marlinspike's Convergence would be the closest thing, iirc. Whenever you access example.com, you ask a handful of user-selected notary servers to access example.com and tell you its TLS cert. If all of them match, you're not being MITMed. You don't have to trust any individual notary server, because it's all of them put together that provide the trust. Of course, trying to figure out a good UX for "my Government and Google say it's fine, but Estonia and Facebook say it's not" in such a way that users aren't going to be severely inconvenienced by a malfunctioning/MITMed notary server but also aren't going to click on "I have no idea what this is just let me see the website" on a MITMed page is hard - probably impossible. Moxie has since given up on it.