4 ms·

From the average user's POV: no They won't know the difference between a lock and a green bar. I would bet a percentage of users don't even notice if they are

by nadams 11y ago

From the average user's POV: no They won't know the difference between a lock and a green bar. I would bet a percentage of users don't even notice if they are browsing an site using SSL or even understand why HTTP without SSL is bad. This was proven with tools like Firesheep where people are more than happy to browse facebook on an open wifi connection without using SSL. I know I saw a discussion with the Chrome team talking about showing an error-like page for all non HTTPS traffic. This is not the solution - the solution is to show some sort of message to the user that is non-blocking that says "hey your information is sent in the clear". Also - change the self-signed SSL to not look like an error page. Using self-signed SSL is more secure than not using SSL at all - even if the certificate isn't verified your data over the wire is encrypted.

netheril96 11y ago
I am a Chinese and here most websites don't even use TLS to encrypt the login page, let alone the whole websites. No one bats an eye. Every time I raise the issue it was just met with indifference. At least browsing Facebook in open wifi (several years ago) leaked only the cookies not the password.
hackuser 11y ago
> They won't know the difference between a lock and a green bar. I would bet a percentage of users don't even notice if they are browsing an site using SSL or even understand why HTTP without SSL is bad. I would bet this percentage is much higher than many people here think. Most people have no idea what "http" means, or even what a protocol is or why they would need one, much less URLs, HTTPS, SSL certs, encryption, identity, validation, etc. Many users whom I observe don't understand the URL field. If they want to load http://cnn.com http://cnn.com, they type "cnn" into the Google search field and click the first link -- for sites they regularly visit, every time, multiple times per day! Many don't know what a web browser is. [1] The idea that they will grasp EV certs, and all knowledge required for that it (certs, issuers, identity, encryption, what does encryption have to do with identity, etc etc etc) seems very unlikely. [1] https://www.youtube.com/watch?v=o4MwTvtyrUQ https://www.youtube.com/watch?v=o4MwTvtyrUQ
- noinsight 11y ago
  > they type "cnn" into the Google search field and click the first link Yeah, they even click the ad links, which makes me cringe every time.
MichaelGG 11y ago
You can't have encryption without authentication. So self-signed needs an error because it looks exactly like an attack. The only time its OK to not warn about self-signed is if you're using HTTP (unencrypted) and the browser did some opportunistic upgrade to prevent totally passive attacks. But no indicator of security should be shown at all.
- nadams 11y ago
  > You can't have encryption without authentication. Sure you can - symmetric encryption. If you have the same key to encrypt and decrypt - you can't be sure you are talking to a good guy on the other end. I think what you mean is you can't have secure communication over HTTP without authentication - which I would agree with. But there are ways to accomplish that without a CA such as certificate pinning. Right now though - only technical people would know how to do that. There should be a non-scary button that shows up the first time to a friendly page that says "I don't trust the certificate that was presented - but this is the first time you are going to the page - would you like for me to continue and remember the certificate for future connections?" Obviously something a little more user friendly - but I think you get the idea. > So self-signed needs an error because it looks exactly like an attack. Same logic applies to HTTP then - without SSL you can't know for sure if there is an attacker in the middle or even if you are talking to a bad guys server. Self signed certificate will at least make it so that people that web traffic sent over open wifi won't be sent in the clear. It could be a guy doing a MITM attack - sure but he could have just as easily MITM your HTTP traffic. However, showing an error page for HTTP traffic would be insane and have a huge drop in web traffic due to people not knowing what to do. You seem to be in favor of the current CA system - if recent history has taught us anything (superfish ring a bell?) - that the current system is completely and utterly broken. Do you check on a regular basis the list of CA certs that are installed on your system? If not - how do you know that you don't have a CA cert that was put there without your knowledge - that would allow someone to sign an SSL certificate for any domain on the planet and your computer or mobile device will automatically accept it.
  - MichaelGG 11y ago
    Unauthenticated symmetric encryption is full of problems. Using the HTTPS URI schema indicates you're asking for a secured connection. That is why the errors exist. Not because of some general security principle. HTTP has no security connotation hence no issues. The CA system isn't great. But it's far from totally broken. Ask CNNIC about how issuing bad CA certs worked out for them.

by nadams 11y ago

netheril96 11y ago

I am a Chinese and here most websites don't even use TLS to encrypt the login page, let alone the whole websites. No one bats an eye. Every time I raise the issue it was just met with indifference. At least browsing Facebook in open wifi (several years ago) leaked only the cookies not the password.

hackuser 11y ago

> They won't know the difference between a lock and a green bar. I would bet a percentage of users don't even notice if they are browsing an site using SSL or even understand why HTTP without SSL is bad. I would bet this percentage is much higher than many people here think. Most people have no idea what "http" means, or even what a protocol is or why they would need one, much less URLs, HTTPS, SSL certs, encryption, identity, validation, etc. Many users whom I observe don't understand the URL field. If they want to load http://cnn.com http://cnn.com, they type "cnn" into the Google search field and click the first link -- for sites they regularly visit, every time, multiple times per day! Many don't know what a web browser is. [1] The idea that they will grasp EV certs, and all knowledge required for that it (certs, issuers, identity, encryption, what does encryption have to do with identity, etc etc etc) seems very unlikely. [1] https://www.youtube.com/watch?v=o4MwTvtyrUQ https://www.youtube.com/watch?v=o4MwTvtyrUQ

noinsight 11y ago
> they type "cnn" into the Google search field and click the first link Yeah, they even click the ad links, which makes me cringe every time.

MichaelGG 11y ago

You can't have encryption without authentication. So self-signed needs an error because it looks exactly like an attack. The only time its OK to not warn about self-signed is if you're using HTTP (unencrypted) and the browser did some opportunistic upgrade to prevent totally passive attacks. But no indicator of security should be shown at all.

nadams 11y ago
> You can't have encryption without authentication. Sure you can - symmetric encryption. If you have the same key to encrypt and decrypt - you can't be sure you are talking to a good guy on the other end. I think what you mean is you can't have secure communication over HTTP without authentication - which I would agree with. But there are ways to accomplish that without a CA such as certificate pinning. Right now though - only technical people would know how to do that. There should be a non-scary button that shows up the first time to a friendly page that says "I don't trust the certificate that was presented - but this is the first time you are going to the page - would you like for me to continue and remember the certificate for future connections?" Obviously something a little more user friendly - but I think you get the idea. > So self-signed needs an error because it looks exactly like an attack. Same logic applies to HTTP then - without SSL you can't know for sure if there is an attacker in the middle or even if you are talking to a bad guys server. Self signed certificate will at least make it so that people that web traffic sent over open wifi won't be sent in the clear. It could be a guy doing a MITM attack - sure but he could have just as easily MITM your HTTP traffic. However, showing an error page for HTTP traffic would be insane and have a huge drop in web traffic due to people not knowing what to do. You seem to be in favor of the current CA system - if recent history has taught us anything (superfish ring a bell?) - that the current system is completely and utterly broken. Do you check on a regular basis the list of CA certs that are installed on your system? If not - how do you know that you don't have a CA cert that was put there without your knowledge - that would allow someone to sign an SSL certificate for any domain on the planet and your computer or mobile device will automatically accept it.
- MichaelGG 11y ago
  Unauthenticated symmetric encryption is full of problems. Using the HTTPS URI schema indicates you're asking for a secured connection. That is why the errors exist. Not because of some general security principle. HTTP has no security connotation hence no issues. The CA system isn't great. But it's far from totally broken. Ask CNNIC about how issuing bad CA certs worked out for them.