7

What should be done (or at least declared) so end-users, visitors will start trusting your website?

Some thoughts:

  • secured login (via https)
  • privacy policy (hidden email and other private information)
  • strong password check
  • custom error page with feedback
  • recaptcha
  • 3
    I really think it depends a great deal on who your end-users are, and what kind of site it is. E.g. security.stackexchange.com would have a tougher time than cooking.stackexchange.com... and of course a bank even tougher (though bank users are usually easier...) – AviD Nov 12 '10 at 0:44
  • 2
    recaptcha is an excellent example - it's impressive for a common user (looks like serious security), but in reality there is very little security benefit to using it (aka security theater). – AviD Nov 16 '10 at 12:26
7

https/SSL everywhere. Securing just the login is useless, as its trivial to steal session cookies from unsecured connections (see http://codebutler.github.com/firesheep/).

Never send them their password. In a proper designed system, that is impossible anyway (only storing hashed, salted passwords, not the actual password). Yet way too many sites still do that.

  • Better yet, don't store the password/user identity at all. Make someone else do it -- openID/LiveID etc. – Steve Dec 2 '10 at 23:11
4

Security is probably the last thing a common user thinks about when trusting a web site.

Think about going to huge brick and mortar companies' websites. When people go to macys.com or bloomingdales.com, the last thing they are thinking about is security. Those stores have such a strong brand, that people feel safe despite what the security situation might be.

Think about how many people are tricked by phishing attempts. If the common user actually cared, they shouldn't be falling for common phishing tricks.

1

Very slightly away from topic, but you'll see my point:

Banks have started using security services as a value add in marketing, for example 2 factor authentication and smart cards - these used to be just for high net worth clients and company accounts, but are being sold to individuals on the basis of providing extra security to them.

Also Trusteer Rapport is an example of a 3rd party application which provides extra security and authentication over connections between user and website. It is being heavily marketed on the public's fear of phishing.

Basic security controls done well just aren't newsworthy enough, so to get users to trust your site due to IT controls, you need something a bit extra.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.