4 ms·

I don't assist this notion. (Compare below, https://news.ycombinator.com/item?id=20573009 https://news.ycombinator.com/item?id=20573009) Understanding the basi

I don't assist this notion. (Compare below, https://news.ycombinator.com/item?id=20573009 https://news.ycombinator.com/item?id=20573009) Understanding the basics of a secure connection and what possible consequences are is part of liability and being of sound mind. Teach them first, what it is and why it matters, to never engage in a critical communication without a verified secure connection as indicated by this and that signal. Facilitate users in asserting the mode of their electronic interactions. Then put an additional warning line on. But never replace the former by the latter. There is no "easy mode" when it comes to your livelihood. And, if users are able to grasp these basics (and sure they are – heck, not that long ago drivers had to understand and to be able to describe the workings of a car engine and transmission in order to pass a drivers test), understanding why a basic connection has become unbearable, shouldn't be much of a problem.

Avamander 7y ago
I assist the notion because I've seen people get phished by pages with TLS certs for a long long time. The teaching that "HTTPS == secure" is just malicious and has to be dropped.
- masswerk 7y ago
  Which is, why there should be more, not less information available to the user (without clicking the TLS icon and probably proceeding into a sub-dialog.) Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain. Edit: E.g., have a dedicated status bar, displaying to whom the certificate was issued by what CA and what the security level (level of identification) is, possibly color coded. (Your bank must have a red certificate issued on its name, otherwise, run.) Prefetch certificates for links and display them side by side with the link target in said status bar, etc,...
  - Avamander 7y ago
    > Which is, why there should be more, not less information available to the user (without clicking the TLS icon and probably proceeding into a sub-dialog.) We gave all the information to users already, they didn't know what to do with it. > Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain. Establishing non-TLS as insecure is the end goal. > possibly color coded. (Your bank must have a red certificate issued on its name, otherwise, run.) Prefetch certificates for links and display them side by side with the link target in said status bar, etc,... Colors mean different things in cultures and have to be manually learned. Due to frequently broken TLS configurations and similar users will ignore the warnings as well. I really really don't think warnings help, either a fail-shut behavior is enforced (with annoying bypasses) or it might as well not exist.
    - deleted 7y ago
      [deleted]
    - masswerk 7y ago
      Safari actually does (or did it): normal (grey) https icons for normal certificates as well as color coded icons including an abbreviated version of the party the certificate was issued to. (Compare this to variations of shield icons you have to click onto for further information in Firefox, which deems me to be much more cryptic.) As for colors or other signaling, yes, these are mostly cultural and are to be learned. (E.g., red isn't naturally "bad" or a warning, it may be rather "important") However, this is such a crucial technology, isn't it a viable option having a set of rules, which easily fits on a single page of legal paper in big print, and teach this to everyone? (How do people manage to cross the street, if they can't be expected to incorporate a simple set of rules? We, on the other hand, rather teach them to be careless and suspend judgement. Notably, I'm speaking of the desktop environment, mobile has a completely different set of requirements and widely proliferated alternatives, like dedicated apps for crucial tasks.) And, regarding don't care about the identity as long as it is TLS, I'm not so sure.
  - tialaramex 7y ago
    > Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain. What we are working towards is the thing users had been assuming was true all along, that when they visit google.com that's google.com, else why would it say so? They are astonished to learn that Tim's toy hypermedia system didn't do that and we're only fixing it now in the 21st century. Whereas you're talking about the sort of imaginary world where everybody begins a novel by perusing the copyright notice just inside the cover, to discern whether they are in fact permitted to read further. Users aren't going to try to figure out what your "dedicated status bar" means, they'll be annoyed that they can't switch it off since it wastes space with things they don't care about and then they'll just stop seeing it, the way they don't really see those channel ID logos (DOGs) on a modern TV channel. Your "prefetching" idea is not only terrible for privacy it also doesn't actually do what you probably expect it does, because web pages are too complicated and have been for decades, for this to be effective. In practice because there are so many HTTP transactions _only_ the checks the software can do automatically are worth anything, any time you start talking about how a user should be examining certificate details you're talking about an idea that can't actually work.
    - masswerk 7y ago
      > Whereas you're talking about the sort of imaginary world where everybody begins a novel by perusing the copyright notice (…) Not so much. I'm referring to a world where different weight and importance apply to different matter. There are things that are important and things that are really important (like your bank connection) and it is really the latter which matter. > Users (…) e annoyed that they can't switch it off since it wastes space with things they don't care about (…) With much the same anticipation we may expect users to hate the Start menu in Windows, since it occupies some space and they neither understand nor use it. Now guess, what happened. (Turns out, users are interested in knowing how to control their devices.) Regarding prefetching, this was just escalating the idea. (In actuality, I'm not a friend of prefetching for any means. Don't waste bandwidth on a general level, just because you can't serve your assets in a time span that had been barely bearable with modems.)
      - 7y ago
- notahacker 7y ago
  To that extent, the "urls aren't specific patterns to accurately copy, they're just words you type like Google searches" user approach promoted with this design is equally unhelpful...
  - Avamander 7y ago
    To be fair URLs look gibberish for most of the world because pretty much no browsers do IRIs and a lot of services are actively hostile to IRIs and IDNs, it is a step up in usability for most of the world to see "just words you type" instead of most URLs.
    - notahacker 7y ago
      It's a step up in usability for everyone, including native English speakers who know what https means but can't remember the precise url, but a step down in security from type magic incantation correctly

Avamander 7y ago

I assist the notion because I've seen people get phished by pages with TLS certs for a long long time. The teaching that "HTTPS == secure" is just malicious and has to be dropped.

masswerk 7y ago
Which is, why there should be more, not less information available to the user (without clicking the TLS icon and probably proceeding into a sub-dialog.) Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain. Edit: E.g., have a dedicated status bar, displaying to whom the certificate was issued by what CA and what the security level (level of identification) is, possibly color coded. (Your bank must have a red certificate issued on its name, otherwise, run.) Prefetch certificates for links and display them side by side with the link target in said status bar, etc,...
- Avamander 7y ago
  > Which is, why there should be more, not less information available to the user (without clicking the TLS icon and probably proceeding into a sub-dialog.) We gave all the information to users already, they didn't know what to do with it. > Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain. Establishing non-TLS as insecure is the end goal. > possibly color coded. (Your bank must have a red certificate issued on its name, otherwise, run.) Prefetch certificates for links and display them side by side with the link target in said status bar, etc,... Colors mean different things in cultures and have to be manually learned. Due to frequently broken TLS configurations and similar users will ignore the warnings as well. I really really don't think warnings help, either a fail-shut behavior is enforced (with annoying bypasses) or it might as well not exist.
  - deleted 7y ago
    [deleted]
  - masswerk 7y ago
    Safari actually does (or did it): normal (grey) https icons for normal certificates as well as color coded icons including an abbreviated version of the party the certificate was issued to. (Compare this to variations of shield icons you have to click onto for further information in Firefox, which deems me to be much more cryptic.) As for colors or other signaling, yes, these are mostly cultural and are to be learned. (E.g., red isn't naturally "bad" or a warning, it may be rather "important") However, this is such a crucial technology, isn't it a viable option having a set of rules, which easily fits on a single page of legal paper in big print, and teach this to everyone? (How do people manage to cross the street, if they can't be expected to incorporate a simple set of rules? We, on the other hand, rather teach them to be careless and suspend judgement. Notably, I'm speaking of the desktop environment, mobile has a completely different set of requirements and widely proliferated alternatives, like dedicated apps for crucial tasks.) And, regarding don't care about the identity as long as it is TLS, I'm not so sure.
- tialaramex 7y ago
  > Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain. What we are working towards is the thing users had been assuming was true all along, that when they visit google.com that's google.com, else why would it say so? They are astonished to learn that Tim's toy hypermedia system didn't do that and we're only fixing it now in the 21st century. Whereas you're talking about the sort of imaginary world where everybody begins a novel by perusing the copyright notice just inside the cover, to discern whether they are in fact permitted to read further. Users aren't going to try to figure out what your "dedicated status bar" means, they'll be annoyed that they can't switch it off since it wastes space with things they don't care about and then they'll just stop seeing it, the way they don't really see those channel ID logos (DOGs) on a modern TV channel. Your "prefetching" idea is not only terrible for privacy it also doesn't actually do what you probably expect it does, because web pages are too complicated and have been for decades, for this to be effective. In practice because there are so many HTTP transactions _only_ the checks the software can do automatically are worth anything, any time you start talking about how a user should be examining certificate details you're talking about an idea that can't actually work.
  - masswerk 7y ago
    > Whereas you're talking about the sort of imaginary world where everybody begins a novel by perusing the copyright notice (…) Not so much. I'm referring to a world where different weight and importance apply to different matter. There are things that are important and things that are really important (like your bank connection) and it is really the latter which matter. > Users (…) e annoyed that they can't switch it off since it wastes space with things they don't care about (…) With much the same anticipation we may expect users to hate the Start menu in Windows, since it occupies some space and they neither understand nor use it. Now guess, what happened. (Turns out, users are interested in knowing how to control their devices.) Regarding prefetching, this was just escalating the idea. (In actuality, I'm not a friend of prefetching for any means. Don't waste bandwidth on a general level, just because you can't serve your assets in a time span that had been barely bearable with modems.)
    - 7y ago
notahacker 7y ago
To that extent, the "urls aren't specific patterns to accurately copy, they're just words you type like Google searches" user approach promoted with this design is equally unhelpful...
- Avamander 7y ago
  To be fair URLs look gibberish for most of the world because pretty much no browsers do IRIs and a lot of services are actively hostile to IRIs and IDNs, it is a step up in usability for most of the world to see "just words you type" instead of most URLs.
  - notahacker 7y ago
    It's a step up in usability for everyone, including native English speakers who know what https means but can't remember the precise url, but a step down in security from type magic incantation correctly