The Untrusted Certificate Dialog

1. Martijn May 2, 2007

   So, do you also have ideas on how a better dialog should look? Instead of just criticizing the current one?
2. Kevin Kofler May 2, 2007

   Well, for one it should say what the error really is: is it a self-signed certificate? (This special case is easy to detect in software, and a common case.) Is it an expired certificate? (That one even results from a specific error from the SSL validation which is then often turned into that generic error.) Too bad most browsers just spit out that generic error. (Konqueror does that too, but at least when you click “Details”, it gives reasons for why the cert is invalid, so it says if it’s self-signed, expired or whatever. I’d prefer having those in the main dialog though. But Firefox doesn’t even bother giving you reasons in the details, it just spits out the cert’s data and lets you do the validations yourself.)
3. Brian Nickel May 2, 2007

   A decent POSTDATA dialog would require a smarter browser. Upon submitting the page, the browser would store some interesting information, like a field was named “pass” or “comments”, a 15MB file was sent, a “image/png” was sent, etc. The address could be useful too, like “login.php”

   The dialog could then say something like, “You originally sent data (via POSTDATA) to view this page, to view it again would require you to resend the data. …”

   * “It appears you submitted your login information. It would probably be harmless to continue.”
   * “It appears you submitted a 15MB media file called ‘animals-wearing-hats-with-a-wide-angle-lense.ogg’. You probably do not want to post this again.”
   * “It appears you posted a comment on a blog or forum. You probably do not want to post it again.”

   If the page is being navigated to, an additional button, “Return to previous page” could be helpful.
4. GUEST May 2, 2007

   IMHO Opera has rather useful dialogs.
5. Bryan Clark May 2, 2007

   @martijn: Well it’s difficult to remove. Because until you tackle the phishing problem that guilt/legal issue is going to stick around. But if we assumed we had a solution for that I wouldn’t use a dialog at all. The invalid cert would be treated like a javascript error, similar notification principle as they are both only interesting to people who understand the tech.
6. Scott Lamb May 2, 2007

   I just realized your advogato post was syndicated from here. I don’t know if you saw my two posts there, but your comments about “C” are horribly wrong!

   http://www.advogato.org/person/slamb/diary.html?start=61
   http://www.advogato.org/person/slamb/diary.html?start=60
7. Scott Lamb May 2, 2007

   Here is Safari’s text for comparison. It gets right to the point, which is that you shouldn’t supply confidential information.

   Safari can’t verify the identity of the website “www.slamb.org”.

   The certificate for the website was signed by an unknown certifying authority. You might be connecting to a website that is pretending to be “www.slamb.org” which could put your confidential information at risk. Would you like to connect to the website anyway?

   [?] [Show Certificate] … (gap here) … [Cancel] [Continue]
8. Bryan Clark May 2, 2007

   @kevin: I agree that when looking at the error message the browser should just be able to tell you what is wrong with it instead of you figuring it out from the cert. Assuming the phishing problem can be handled I wouldn’t suggest keeping the dialog around, I think it can be handled like a site error message. Of course if you load a page with a form it might be a good time to warn people that things aren’t secure.

   @scott: I think you’re missing the real error with these dialogs. The problem is that your user had the intention to view the web site the dialog is warning about. They want to be there. Again, putting aside the problems of phishing. So it doesn’t really matter what dialog you put in front of them, nobody reads the text. These dialogs look like the hobos wearing signs that say “The End is Near”, sure they get in your way on the sideway and sound scary if you took the time but everyone just walks around them. And the SSL cert validity doesn’t actually matter until someone sends information the site, while you’re just viewing it there’s nothing wrong with an expired cert. When somebody submits information, then you might have an issue.
9. Scott Lamb May 2, 2007

   I think you’re missing the point of the dialog. The user did *NOT* intend to view the website the dialog is warning about. The user intended to go to Big Bank’s website, and this dialog box is breaking the bad news that isn’t it. The browser is unable to satisfy the user’s desire to go to Big Bank’s website.

   The cert validity can in some cases matter when viewing the page. I focused on sending information because that’s the most common case, but users can take out-of-band actions based on information obtained from a trusted source. It is important that they know this is not a trusted source.

   Everybody does not walk around this warning. The “Aunt Tillie” crowd does not often go to mailing list sites which use SSL for no particular reason. They primarily use SSL for online banking and resellers like amazon.com. If they get a security warning at one of those sites, it is much much much more likely someone is trying to steal their money than that amazon.com screwed up SSL or is using a homegrown CA.
10. Scott Lamb May 2, 2007

    Actually, I take that back: it’s not much much much more likely someone is trying to steal their money. It WOULD be much much more likely, except that the well-known existence of this dialog box discourages people from trying to forge amazon.com’s credentials. If this dialog box did not exist or if it were redesigned by someone who missed its entire point, people frequently would steal money in this manner.
11. Anonymous May 2, 2007

    One way to make the POST-request-again dialog a little better might be something like:
    —
    “You went beyond this page earlier and then returned back to it using the browser history. Now you’re trying to go beyond it again. Do you want to return to where you were before or start fresh?”

    [Start Fresh] [Return to where I was]
    —
    ([Start Fresh] would repeat the POST request and [Return to where I was] would pull the page one page forward in the history from the browser cache.
12. Joe Buck May 3, 2007

    The solution to the Firefox POSTDATA dialog is not to change the dialog. The need to present it at all is a symptom of broken Firefox behavior. I typically see it when I hit the “back” button, and what I want to see is the page I just saw before I clicked whatever I clicked. I don’t want Firefox to re-submit a form. I want it to remember the last page and re-draw it, quickly. If I’m stuck on dialup, I don’t expect a long delay; I expect the browser to just remember the page. After all, the damned program is sucking up 100Mb or more of storage and tons of disk cache.

    If the broken Firefox behavior is fixed, then there’s no need for figuring out how to re-word the dialog.

    Similarly, one of the most common areas of breakage with certs is that the certificate covers http://www.foobar.com and I’m visiting foobar.com, or vice versa. You say that the issue is that the site is misconfigured. But the certification authorities charge more for a wildcard certificate, so people on a budget don’t pay. For close matches of this kind, the browser should, once again, shut up.
13. Brian Nickel May 3, 2007

    I have to disagree with Scott. Most of the time, I receive the error is from a badly configured server. Like https://www.foo.com and https://secure.foo.com showing the same site, but only secure.* has a certificate. The user DOES want to go to the site, but something is standing in the way. Something that says: “This site has invalid credentials for ‘reason x’. This may be due to a badly set up website or a site pretending to be ‘foo.com’ for fraudulent purposes. You should not trust this website with personal information.” [Go Back] [Continue]

    - Brian

    PS. [Go Back] or [Previous Page] may me more useful to the user than [Cancel]
14. fraggle May 3, 2007

    WALL OF TEXT
15. James May 3, 2007

    OK — how about:

    This site is supposed to be trusted, but the site’s “certificate” is [broken/out of date/not trusted/delete as appropriate].

    This may mean you’re connecting to someone *pretending* to be http://www.url.com

    If you choose to visit it anyway, treat it with suspicion! Don’t enter any personal information, such as credit card numbers!

    [ Visit it anyway ] [ View certificate ] [ Keep away! ]
16. Bryan Clark May 3, 2007

    @scott: I’be been trying to separate these two issues, but they keep getting clouded. Intending to go to your bank and ending up somewhere else is phishing and phishing is a serious problem. I don’t think that this cert dialog is actually helping to curtail the phishing problem, I do think this dialog just becomes noise to people because it also appears when a site is simply misconfigured. Essentially it is crying wolf to the person and they will eventually tend to just click through it. And I completely agree that serious sites like banks and amazon won’t screw up their certificates, so there’s not much reason to block people from using sites with bad certs assuming you have a solution to the phishing problem. I just went to core.fluendo.com and they have a bad cert, but it doesn’t mean they are going to steal my identity. Like Brian points out, most of the time it’s a badly configured server, so to help our users we should try not to cry wolf about that.
17. Scott Lamb May 3, 2007

    James:

    That text is not bad, minus the extraneous quotes around “certificate”. (”Using this ‘laser’, I will…”)

    Bryan:

    You’ve been unsuccessful because it’s impossible - the issues are inseparable. The browser does not know the server administrator’s intent. It is unable to distinguish between a “configuration problem” of inadvertently sending a valid certificate for another site and a “security problem” of deliberately sending a valid certificate for another site. I’m skeptical even of heuristics like “‘example.com’ and ‘www.example.com’ are basically the same”.

    What you’re doing is like trying to come up with a smart lock that can distinguish between the “forgetfulness issue” of someone forgetting the key and the “security issue” of someone not having the key. You can’t do it - all the lock sees is a “no key issue”, and its policy is to refuse entry. Maybe the “forgetfulness issue” is more common in some situations, but the “security issue” would be common as hell if the lock’s policy was to let people in anyway.

    You are convincing me that there is more danger here than I’d realized. Aunt Tillie on her own would handle Safari’s dialog box fine. But the real danger is that her “computer genius” nephew will tell her to ignore it - it’s probably not important because he gets this security warning at his friend Joe’s website and no one has ever stolen his credit card there.
18. Steven Garrity May 3, 2007

    For comparison, here’s a screenshot of the IE7 equivalent:

    http://actsofvolition.com/images/screenshots/web/windows-cert-error.png
19. Anonymous May 3, 2007

    My bank has a two stage authentication process where after I enter my username, it then shows me a picture I chose specifically when I created the user.

    Since it’s a picture I chose and see every time I login, if I ever see a different picture I’ll immediately realize something is up and be cautious about entering my login credentials.

    I think that type of phishing prevention is much more useful than the browser cert warning.
20. Scott Lamb May 3, 2007

    Anonymous: unfortunately, you’re wrong. Your bank’s website is no more secure - and possibly less - for doing this. They should stick to tried and true methods.

    Why more no secure? They are proving their identity by sending a shared secret (the picture) to an unauthenticated party. That provides no protection against a man-in-the-middle attack. If I can get you to load my fake webpage, I can also relay your username request to the bank so I can display the correct picture.

    Why less secure? Unless they’re smart enough to display a random picture on unknown username, this technique provides a simple way to test the existence of an account.
21. Richard May 3, 2007

    Fixing the POSTDATA dialog is easy if you are the webmaster. Simple do a silent http redirect for every page that recieves postdata, then the actual postdata event does not show up in the browser history. A nice and convinient solution IMHO. I am not sure whether this “should” be solved in the browser actually.

    Cheers
    -Richard
22. 34412-8160 July 11, 2007

    Bryan- I got a laugh out of your asessment, because this just happened to me and you’re totally right- how the heck am I supposed to know what the “fingerprints” are or whether they look “ok”? (but for the record I did “carefully examine” them anyway). But I agree with the others, that this is a necessary popup, it just needs to become a little more useful, or webmasters need to be a little less lazy (because I encountered it on the gmail login, and NOW for “*mozilla.org”.. hehe, what the heck is this??). IDK, maybe I’m running too old of a version of firefox or something? don’t know if its the browser or the websites…

Post a Comment »