Informed choices and real security
David makes an excellent point about choices in a user interface. What David assumes in his post is that I think people shouldn’t be able to make informed choices in their Desktop interface. Well that’s not true, what’s missing my my previous post is that I don’t want to take away peoples ability to make informed choices, however I do want to stop the computer from forcing people into making uninformed guesses.
People who understand SSL and Certificates need to be notified if a site is incorrectly using them so they can choose to discontinue using that site if the situation merits that. Most of the time the issue with these is just a misconfiguration, and for someone who understands those technologies it’s not hard to spot. However most people don’t understand those technologies.
The decision is more complicated than this, but when building a web browser there are a couple paths the creators could take related to handling certificates.
- Deny people from browsing to sites that don’t have correctly signed certificates, no choices (security for all)
- Ignore certificates completely (no security for anyone)
- Ask every person using the web browser to examine bad certificates for validity (security for few)
- Or a New Solution (security for most)
My assumption is that most people don’t understand SSL and Certificates. I think that’s a pretty solid assumption so lets put a number on it, like 90% of people don’t understand the technology; seems a fair number. The assumption of the web browser is that if the certificate is bad ask the user if it’s ok to continue. That means the creators of the web browser have to hope for only a 10% chance of getting the right answer from the user. Those are really bad odds.
There are lots of other people talking about usability and security and several papers like Are Usability and Security Two Opposite Directions in Computer Systems? [pdf] and Usability of Security: A Case Study [pdf] on the topic. My Summary: If you want most people who use your software to have a secure experience you can’t ignore their inability to make certain choices about security. This doesn’t mean taking away the choice from them or from you, this means providing methods for them to be informed enough to make a decent choice. Those methods might also save a person in the know some extra time.
Just as an idea point for a new solution. Digg and other sites like it usually have a very low number of key people who push out most of the news that really gets dugg high. You might speculate that it’s a similar ratio to the number of people who understand SSL and Certificates and if a site is safe or not. So if people in the know about safety of a site could “Digg” it such that others would be informed that a “High number of people believe this to be safe” they could make some kind of informed decision about continuing to use the site.
And remember! Safety is no accident
9 Comments
Jump to comment form | comments rss [?] | trackback uri [?]