4 ms·

> There's nothing stopping spammers from signing their spam. The pain point with signing and encryption is key rotation. Yes, but those signatures can't be ver

> There's nothing stopping spammers from signing their spam. The pain point with signing and encryption is key rotation. Yes, but those signatures can't be verified. I understand this is tricky problem; how do we prevent people from simply clicking "accept this unknown key"? I'm not sure; but not every user is a blubbering idiot, and "unknown signature" strikes me as a lot better UX than "carefully look for spelling errors or misleading domain names".

rebuilder 8y ago
Why couldn't they get a certificate for accepourtos.com?
chx 8y ago
https://twitter.com/miradoreltd/status/843877685675868160 https://twitter.com/miradoreltd/status/843877685675868160 adopted from http://blog.johnath.com/images/snotweasel.png http://blog.johnath.com/images/snotweasel.png [Transcription: Windows XP error dialog with the yellow triangle - title "Something happened and you need to click OK to get on with things." details: "Certificate mismatch security identification administration communication intercept liliputian snotweasel foxtrot omegaforce." then you have a button saying Technical Crap and three radio buttons 1) More technical crap 2) Hoyvin-Glayvin 3) Launch photon torpedoes and then OK and Cancel buttons.]
- riffraff 8y ago
  I will argue that something like the chrome untrusted certificate warning will scare away most of the users. https://i.stack.imgur.com/r0iOf.png https://i.stack.imgur.com/r0iOf.png
  - Thlom 8y ago
    Maybe, but then again they get the same message every day at work when accessing their business application with outdated certificate or whatever and have been used to just bypass it ...
  - tialaramex 8y ago
    Nope. Back in the old days Microsoft actually did tests on this in Internet Explorer, with users real banking credentials not fake ones, so that the user would properly value giving credentials away. The only thing that actually works is brick wall UX. If you don't give the user the option to ignore the problem, they are forced to give up, which was the only safe option for them. If there's a way to continue, despite it being unsafe, users will do that. Humans have a psychological defect in which they become rigorously focused on achieving a specific objective, and screen out indications that this is a bad idea. This is why those signs saying "Danger! Low bridge" aren't as effective as you'd expect. The human driving the over-height vehicle is focused on getting to the other side of the bridge, your warning signs aren't helping them do that, so they ignore them. This is why a modern Firefox has brick wall UX for some HTTPS problems and would like to do it for more such problems. Only brick wall UX keeps people safe. This is also why "bad idea" and similar Chrome overrides for their brick wall have to be changed periodically, these start a "power user" feature for people who actually do what they're doing, but quickly they spread and are used by people just trying to get things done, without grasping that now they're completely insecure.
    - Noumenon72 8y ago
      That brick wall UX keeps me from using Firefox on my work intranet, since we have a self-signed certificate it doesn't like. I kind of wish the other browsers did the same, so they would actually fix it instead of everyone having to click the insecure warning to continue five times a day.

rebuilder 8y ago

Why couldn't they get a certificate for accepourtos.com?

chx 8y ago

https://twitter.com/miradoreltd/status/843877685675868160 https://twitter.com/miradoreltd/status/843877685675868160 adopted from http://blog.johnath.com/images/snotweasel.png http://blog.johnath.com/images/snotweasel.png [Transcription: Windows XP error dialog with the yellow triangle - title "Something happened and you need to click OK to get on with things." details: "Certificate mismatch security identification administration communication intercept liliputian snotweasel foxtrot omegaforce." then you have a button saying Technical Crap and three radio buttons 1) More technical crap 2) Hoyvin-Glayvin 3) Launch photon torpedoes and then OK and Cancel buttons.]

riffraff 8y ago
I will argue that something like the chrome untrusted certificate warning will scare away most of the users. https://i.stack.imgur.com/r0iOf.png https://i.stack.imgur.com/r0iOf.png
- Thlom 8y ago
  Maybe, but then again they get the same message every day at work when accessing their business application with outdated certificate or whatever and have been used to just bypass it ...
- tialaramex 8y ago
  Nope. Back in the old days Microsoft actually did tests on this in Internet Explorer, with users real banking credentials not fake ones, so that the user would properly value giving credentials away. The only thing that actually works is brick wall UX. If you don't give the user the option to ignore the problem, they are forced to give up, which was the only safe option for them. If there's a way to continue, despite it being unsafe, users will do that. Humans have a psychological defect in which they become rigorously focused on achieving a specific objective, and screen out indications that this is a bad idea. This is why those signs saying "Danger! Low bridge" aren't as effective as you'd expect. The human driving the over-height vehicle is focused on getting to the other side of the bridge, your warning signs aren't helping them do that, so they ignore them. This is why a modern Firefox has brick wall UX for some HTTPS problems and would like to do it for more such problems. Only brick wall UX keeps people safe. This is also why "bad idea" and similar Chrome overrides for their brick wall have to be changed periodically, these start a "power user" feature for people who actually do what they're doing, but quickly they spread and are used by people just trying to get things done, without grasping that now they're completely insecure.
  - Noumenon72 8y ago
    That brick wall UX keeps me from using Firefox on my work intranet, since we have a self-signed certificate it doesn't like. I kind of wish the other browsers did the same, so they would actually fix it instead of everyone having to click the insecure warning to continue five times a day.