Re: [TLS] TLS, PKI, and web security. Was: Eleven out of every ten SSL certs aren't valid

[Robert Relyea <[e-mail]>]

On 07/03/2010 12:09 AM, Peter Gutmann wrote:
>
> Uhh, going back to the list of studies again, there's been study after study
> after study showing they are ineffective - they have next to no effect on user
> behaviour.  I'll list just one of them:
>
>   "You've Been Warned: An Empirical Study of the Effectiveness of Web Browser
>   Phishing Warnings", Serge Egelman, Lorrie Cranor and Jason Hong, Proceedings
>   of the 2008 Conference on Human Factors in Computing Systems (CHI.08), April
>   2008, p.1065.
>
> because the title sprung to mind when you mentioned "browser warnings".  These
> things don't work.
>   
It seems these are complaining about yesterday's UI. Most browsers no
longer use pop-up menus. You have to be quite aggressive to get through
the current screens.

The real problem, of course, is those sites that don't have valid certs.
Continuing to ratched down the ability to get to those sites is good for
the internet as a whole. Sites with invalid certs are just as dangerous
for the internet as MITM sites.