4 ms·

I'd argue the problem might be the opposite: people are willing to differentiate on some matters (not everything), but security folks fail to help them do so. T

I'd argue the problem might be the opposite: people are willing to differentiate on some matters (not everything), but security folks fail to help them do so. They treat every warning like DEFCON 1, as if an expired certificate is remotely similar to a compromised one. People already understand expiration dates aren't exact. They deal with it in all kinds of places. It's not a new concept.

bawolff 6y ago
So what exactly do you want changed? A warning already comes up explaining what happened that a user can click through. Unless the website has opted into strict mode, in which case warnings cannot be bypassed, which seems very reasonable. > People already understand expiration dates aren't exact. They deal with it in all kinds of places. It's not a new concept. Try crossing the border with an expired passport and see how non-exact expiry dates are.
- mehrdadn 6y ago
  > So what exactly do you want changed? A warning already comes up explaining what happened that a user can click through. Unless the website has opted into strict mode, in which case warnings cannot be bypassed, which seems very reasonable. I'm saying load the website by default; just display a warning that isn't too intrusive or alarming. As a starting point (not suggesting this is peak UX; it's just a starting point for the discussion): it could be just a small balloon notification on the padlock with black text, nothing in red or otherwise alarming (or maybe becoming more red as more time has passed). A little bit like the balloon Chrome displays for "Disable developer-mode extensions". It still lets you use the browser but also gets its point across. > Try crossing the border with an expired passport and see how non-exact expiry dates are. You couldn't think of expiration dates for things that aren't at the extreme? Maybe for actions whose gravity is a little bit more comparable to visiting a website than, say, crossing an international border?
  - bawolff 6y ago
    Actually, i'd be totally fine with that in the run-up to the cert expiring. Although i wonder if it would really make a difference - would the site operator notice such a mild UI change. After all, if they were paying attention they would already have monitoring for cert expiry. > You couldn't think of expiration dates for things that aren't at the extreme? Maybe for things whose gravity is a little bit more comparable to visiting a website than, say, crossing an international border? Passports are a credential, so are certificates. Generally expiry dates are strictly enforced on credentials. Same thing applies to driver licenses, health cards, etc.
    - mehrdadn 6y ago
      If your passport is expired, you don't get to cross. (Or maybe you still do! if you're returning to your home country.) Tough luck for you, but 1 person made a mistake, and 1 person faced the consequences. With an expired certificate, the users (of which there are many) are the ones paying the price, and they're not at fault all. Also, people absolutely do accept expired credentials for some things. Not for others. It depends on the seriousness of the situation and the consequences (especially legal consequences) for failing to validate the IDs properly. You simply can't just pretend visiting a website is anything remotely comparable to crossing a border or producing an ID for law enforcement no matter how much you insist on it, so I'm not going to entertain this anymore.
      - bawolff 6y ago
        I use TLS to secure my online banking. I use TLS to communicate about taxes. Those are hardly trivial things. If you don't like id documents as a comparison despite certificates literally being identity documents, you could compare it to business licenses instead. The reason that food has imprecise expiry dates is because we don't know when food will actually go bad. We do know how it is distributed, so we make a guess and err a couple standard deviations on the side of caution. However, we know precisely when a certificate will expire. The standard deviation for a certificate expiring (ignoring clockskew) is 0. If we gave 5 standard deviations of warning time on a certificate, it would still be 0 warning.
- lokedhs 6y ago
  They're quite non-exact. Most countries won't allow you to cross with a valid certificate if the expiry date is within 6 months in the future.

bawolff 6y ago

So what exactly do you want changed? A warning already comes up explaining what happened that a user can click through. Unless the website has opted into strict mode, in which case warnings cannot be bypassed, which seems very reasonable. > People already understand expiration dates aren't exact. They deal with it in all kinds of places. It's not a new concept. Try crossing the border with an expired passport and see how non-exact expiry dates are.

mehrdadn 6y ago
> So what exactly do you want changed? A warning already comes up explaining what happened that a user can click through. Unless the website has opted into strict mode, in which case warnings cannot be bypassed, which seems very reasonable. I'm saying load the website by default; just display a warning that isn't too intrusive or alarming. As a starting point (not suggesting this is peak UX; it's just a starting point for the discussion): it could be just a small balloon notification on the padlock with black text, nothing in red or otherwise alarming (or maybe becoming more red as more time has passed). A little bit like the balloon Chrome displays for "Disable developer-mode extensions". It still lets you use the browser but also gets its point across. > Try crossing the border with an expired passport and see how non-exact expiry dates are. You couldn't think of expiration dates for things that aren't at the extreme? Maybe for actions whose gravity is a little bit more comparable to visiting a website than, say, crossing an international border?
- bawolff 6y ago
  Actually, i'd be totally fine with that in the run-up to the cert expiring. Although i wonder if it would really make a difference - would the site operator notice such a mild UI change. After all, if they were paying attention they would already have monitoring for cert expiry. > You couldn't think of expiration dates for things that aren't at the extreme? Maybe for things whose gravity is a little bit more comparable to visiting a website than, say, crossing an international border? Passports are a credential, so are certificates. Generally expiry dates are strictly enforced on credentials. Same thing applies to driver licenses, health cards, etc.
  - mehrdadn 6y ago
    If your passport is expired, you don't get to cross. (Or maybe you still do! if you're returning to your home country.) Tough luck for you, but 1 person made a mistake, and 1 person faced the consequences. With an expired certificate, the users (of which there are many) are the ones paying the price, and they're not at fault all. Also, people absolutely do accept expired credentials for some things. Not for others. It depends on the seriousness of the situation and the consequences (especially legal consequences) for failing to validate the IDs properly. You simply can't just pretend visiting a website is anything remotely comparable to crossing a border or producing an ID for law enforcement no matter how much you insist on it, so I'm not going to entertain this anymore.
    - bawolff 6y ago
      I use TLS to secure my online banking. I use TLS to communicate about taxes. Those are hardly trivial things. If you don't like id documents as a comparison despite certificates literally being identity documents, you could compare it to business licenses instead. The reason that food has imprecise expiry dates is because we don't know when food will actually go bad. We do know how it is distributed, so we make a guess and err a couple standard deviations on the side of caution. However, we know precisely when a certificate will expire. The standard deviation for a certificate expiring (ignoring clockskew) is 0. If we gave 5 standard deviations of warning time on a certificate, it would still be 0 warning.
lokedhs 6y ago
They're quite non-exact. Most countries won't allow you to cross with a valid certificate if the expiry date is within 6 months in the future.