0

With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to prevent an attack, assuming that the attackers can't manage to get a valid certificate somehow.

The average error page or error message says something along the lines of "There's a problem with this site's security certificate, and this may mean an attempt to intercept the data you're sending to the server." Admittedly, this is a bit wordy, but I believe it's short enough to keep a user's attention and has enough detail (without going into too much detail) to let the user know that it's not just a "You win a free car and $1,000,000!!!!" sort of thing. There's also that typically the error pages are intrusive and minimally flashy, which I believe will catch the user's attention but not divert it away.

Since this is a fairly subjective question, I'm going to make it as objective as possible: In your experience, what is the average user's reaction to warning pages like this?

  • 6
    A warning page? QUICK HOW DO I BYPASS IT AS QUICKLY AS POSSIBLE TO LOOK AT CAT PICTURES! – NULLZ Aug 27 '13 at 23:19
  • Well, I did my best to make it an objective question, but I guess personal experience isn't quite objective enough. I understand that, personal experience with people will vary from person to person. – demize Aug 28 '13 at 5:11
4

I would add this as a comment if I had the rep but the typical user reaction would be to click through. Your average user has no clue about SSL. As a side note, at my place of employment, our ERP throws an error message due to an unverfiable certificate. The solution to this problem (according to the help desk) is to click through it. I assume most users would take the same course of action on their home computer.

  • 1
    Sadly, that "solution" at your work just increases the problem. They're training the users to ignore security warnings; if your work happened to be attacked down the same vector ... – JoltColaOfEvil Aug 27 '13 at 23:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.