Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What should be done (or at least declared) so end-users, visitors will start trusting your website?

Some thoughts:

  • secured login (via https)
  • privacy policy (hidden email and other private information)
  • strong password check
  • custom error page with feedback
  • recaptcha
share|improve this question
3  
I really think it depends a great deal on who your end-users are, and what kind of site it is. E.g. security.stackexchange.com would have a tougher time than cooking.stackexchange.com... and of course a bank even tougher (though bank users are usually easier...) –  AviD Nov 12 '10 at 0:44
2  
recaptcha is an excellent example - it's impressive for a common user (looks like serious security), but in reality there is very little security benefit to using it (aka security theater). –  AviD Nov 16 '10 at 12:26
add comment

4 Answers

up vote 6 down vote accepted

https/SSL everywhere. Securing just the login is useless, as its trivial to steal session cookies from unsecured connections (see http://codebutler.github.com/firesheep/).

Never send them their password. In a proper designed system, that is impossible anyway (only storing hashed, salted passwords, not the actual password). Yet way too many sites still do that.

share|improve this answer
    
Better yet, don't store the password/user identity at all. Make someone else do it -- openID/LiveID etc. –  SteveS Dec 2 '10 at 23:11
add comment

Security is probably the last thing a common user thinks about when trusting a web site.

Think about going to huge brick and mortar companies' websites. When people go to macys.com or bloomingdales.com, the last thing they are thinking about is security. Those stores have such a strong brand, that people feel safe despite what the security situation might be.

Think about how many people are tricked by phishing attempts. If the common user actually cared, they shouldn't be falling for common phishing tricks.

share|improve this answer
add comment

Everything you stated, also https on EVERY page is better. Try WOT also to make sure your rating is good and possibly add their widget to your site. Also the BBB (Better Business Buru) services might help.

share|improve this answer
add comment

Very slightly away from topic, but you'll see my point:

Banks have started using security services as a value add in marketing, for example 2 factor authentication and smart cards - these used to be just for high net worth clients and company accounts, but are being sold to individuals on the basis of providing extra security to them.

Also Trusteer Rapport is an example of a 3rd party application which provides extra security and authentication over connections between user and website. It is being heavily marketed on the public's fear of phishing.

Basic security controls done well just aren't newsworthy enough, so to get users to trust your site due to IT controls, you need something a bit extra.

share|improve this answer
    
I have worked in a bank. And I understand what you mean saying "basic security" and what money clients should pay for advertising so "safety" services. I think, banks can easy cover all single instance loses from hackers by stopping of paying all ad campaigns about security. –  garik Dec 2 '10 at 21:39
    
Nice point igor, but not sure Worldpay would necessarily agree - see atlanta.fbi.gov/dojpressrel/pressrel09/atl111009.htm –  Rory Alsop Dec 2 '10 at 21:55
    
right, why do i hear from managers every time i visit a bank that credit cards are so safe :)? Really we cannot see all picture of problem because of security :) –  garik Dec 2 '10 at 23:08
    
i think, this answer and discussion are really off-topic and downvoting is a bad luck. –  garik Dec 2 '10 at 23:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.