Some months ago, I watched online a video recording of a talk/presentation aimed at an audience interested in information security.
The talk concerned UI/UX/usability, convenience, and security, and made a number of useful recommendations for people developing software in which those concerns need to be taken into account.
One of the points it made was that by default, browsers do not warn if the user attempts to access a webpage over HTTP, but do warn if the user attempts to access a webpage over HTTPS if there's a problem with the certificate. This produces the false perception in the user that the latter is a greater privacy/security risk than the former. I have not encountered that observation elsewhere.
I recently wanted to reference the talk, but was unable to, as I did not bookmark it and now cannot find it despite extensive web-searching.
My question is: if you have also seen this talk, please can tell me which talk this was, or at least suggest an alternative citable resource that discusses the browser warning issue mentioned above.
In case it helps:
- I probably found the video on YouTube.
- The talk might have been from DEF CON, Black Hat, CCC, or a smaller event: I forget where it was recorded.
- I do not recall when the talk was given, but I think it was within the last decade.
- The talk included at least one screenshot of a browser warning the user about an invalid HTTPS certificate.
- I believe the speaker had a position in academia.
- I thought at first it might have been a talk by Dan Kaminsky or Wesley McGrew, but have re-watched several of their (excellent) talks now without any luck, so it was probably by somebody else.