Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to prevent an attack, assuming that the attackers can't manage to get a valid certificate somehow.

The average error page or error message says something along the lines of "There's a problem with this site's security certificate, and this may mean an attempt to intercept the data you're sending to the server." Admittedly, this is a bit wordy, but I believe it's short enough to keep a user's attention and has enough detail (without going into too much detail) to let the user know that it's not just a "You win a free car and $1,000,000!!!!" sort of thing. There's also that typically the error pages are intrusive and minimally flashy, which I believe will catch the user's attention but not divert it away.

Since this is a fairly subjective question, I'm going to make it as objective as possible: In your experience, what is the average user's reaction to warning pages like this?

share|improve this question

closed as primarily opinion-based by Adi, NULLZ, Xander, Terry Chia, TildalWave Aug 28 '13 at 4:25

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

Well, I did my best to make it an objective question, but I guess personal experience isn't quite objective enough. I understand that, personal experience with people will vary from person to person. – demize Aug 28 '13 at 5:11
up vote 4 down vote accepted

I would add this as a comment if I had the rep but the typical user reaction would be to click through. Your average user has no clue about SSL. As a side note, at my place of employment, our ERP throws an error message due to an unverfiable certificate. The solution to this problem (according to the help desk) is to click through it. I assume most users would take the same course of action on their home computer.

share|improve this answer
Sadly, that "solution" at your work just increases the problem. They're training the users to ignore security warnings; if your work happened to be attacked down the same vector ... – JoltColaOfEvil Aug 27 '13 at 23:57
Well, because of your side note, I'm going to accept your answer - you've given me exactly the insight into how the average person would react I needed. – demize Aug 28 '13 at 0:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.