2 ms·

> Which is, why there should be more, not less information available to the user (without clicking the TLS icon and probably proceeding into a sub-dialog.) We

> Which is, why there should be more, not less information available to the user (without clicking the TLS icon and probably proceeding into a sub-dialog.) We gave all the information to users already, they didn't know what to do with it. > Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain. Establishing non-TLS as insecure is the end goal. > possibly color coded. (Your bank must have a red certificate issued on its name, otherwise, run.) Prefetch certificates for links and display them side by side with the link target in said status bar, etc,... Colors mean different things in cultures and have to be manually learned. Due to frequently broken TLS configurations and similar users will ignore the warnings as well. I really really don't think warnings help, either a fail-shut behavior is enforced (with annoying bypasses) or it might as well not exist.

deleted 7y ago
[deleted]
masswerk 7y ago
Safari actually does (or did it): normal (grey) https icons for normal certificates as well as color coded icons including an abbreviated version of the party the certificate was issued to. (Compare this to variations of shield icons you have to click onto for further information in Firefox, which deems me to be much more cryptic.) As for colors or other signaling, yes, these are mostly cultural and are to be learned. (E.g., red isn't naturally "bad" or a warning, it may be rather "important") However, this is such a crucial technology, isn't it a viable option having a set of rules, which easily fits on a single page of legal paper in big print, and teach this to everyone? (How do people manage to cross the street, if they can't be expected to incorporate a simple set of rules? We, on the other hand, rather teach them to be careless and suspend judgement. Notably, I'm speaking of the desktop environment, mobile has a completely different set of requirements and widely proliferated alternatives, like dedicated apps for crucial tasks.) And, regarding don't care about the identity as long as it is TLS, I'm not so sure.

deleted 7y ago

[deleted]

masswerk 7y ago

Safari actually does (or did it): normal (grey) https icons for normal certificates as well as color coded icons including an abbreviated version of the party the certificate was issued to. (Compare this to variations of shield icons you have to click onto for further information in Firefox, which deems me to be much more cryptic.) As for colors or other signaling, yes, these are mostly cultural and are to be learned. (E.g., red isn't naturally "bad" or a warning, it may be rather "important") However, this is such a crucial technology, isn't it a viable option having a set of rules, which easily fits on a single page of legal paper in big print, and teach this to everyone? (How do people manage to cross the street, if they can't be expected to incorporate a simple set of rules? We, on the other hand, rather teach them to be careless and suspend judgement. Notably, I'm speaking of the desktop environment, mobile has a completely different set of requirements and widely proliferated alternatives, like dedicated apps for crucial tasks.) And, regarding don't care about the identity as long as it is TLS, I'm not so sure.