Re: Browser security warning

Hi all,

My opinion here is that much of what Michael points out below re-inforces 
my point about having to know who we are interacting with.  What is 
informative to one "user" will be useless and unintelligible to another.

I think we need to cater to different user personas (and vary the 
information we provide based on "who" we're interacting with.  Here, I 
defer to colleagues here who are HCI experts (which does not include me).

Happy Holidays,
Tim Hahn

Internet: hahnt@us.ibm.com
Internal: Timothy Hahn/Durham/IBM@IBMUS
phone: 919.224.1565     tie-line: 8/687.1565
fax: 919.224.2530




"Michael(tm) Smith" <mikes@opera.com> 
Sent by: public-wsc-wg-request@w3.org
12/22/06 06:34 AM

To
public-wsc-wg@w3.org
cc

Subject
Re: Browser security warning







michael.mccormick@wellsfargo.com, 2006-12-21 11:58 -0600:

> I just tried to access a reputable web site that issues its own
> SSL certs

How exactly did you make the determination that it's reputable?
(I'm not being facetious.) How could a user be expected to tell it
apart from a unreputable site that has a self-signed cert?

For sites with self-signed certs, I think there's growing support
for the idea of simply not showing any security indicators at all.
If we were to do that consistently across browsers, users would
never see any warning dialog at all for this case, nor any padlock
icon or anything else to indicate that the site has a cert.

> and got this warning message from IE6:
> "You are about to install a certificate from a CA claiming to
> represent www.x9.org.  Windows cannot validate that the
> certificate is actually from www.x9.org.  You should confirm its
> origin by contacting www.x9.org.  The following number will
> assist you in this process:
> Thumbprint (sha1): 8FBF6185 1D390508 F04BA0CB 31F4C4C E5310DAE.
> 
> "Installing a certificate with an unconfirmed thumbprint is a
> security risk.  If you click Yes you acknowledge this risk.  Do
> you want to install this certificate?"

I guess in part this is case of the application providing too much
information. Maybe the part that says "Windows cannot validate
that the certificate is actually from www.x9.org" is enough.

Here's what a few other browsers say for the same site:

-----------------------------------------------------------------
The root certificate for this server is not registered. You may
install this certificate. Accept/install?

- The root certificate from "www.x9.org" is not known to Opera.
Opera cannot decide if this certificate can be trusted.
-----------------------------------------------------------------

-----------------------------------------------------------------
  The server certificate failed the authenticity test.

  Certificate is self-signed and thus may not be trustworthy.
  ...
-----------------------------------------------------------------

-----------------------------------------------------------------
  Unable to verify the identity of www.x9.org as a trusted site.
  Possible reasons for this error:
  - Your browser does not recognize the Certificate Authority that
  issued the site's certificate.
  - The site's certificate is incomplete due to a server
  misconfiguration.
  - You are connected to a site pretending to be www.x9.org,
  possibly to obtain your confidential information.

  Please notify the site's webmaster about this problem.

  Before accepting this certificate, you should examine this
  site's certificate carefully. Are you willing to to accept this
  certificate for the purpose of identifying the Web site
  www.x9.org?
-----------------------------------------------------------------

> I'm a security professional and even I find this message very
> hard to understand and almost completely unactionable.  An
> ordinary user would ask:
> *              What is a certificate?
[...]

It's going to be very hard for any browser to provide information
about the problem without mentioning the word "certificate".

How would you suggest the browser could make an ordinary user
understand what a certificate is so that the user can take action
when encountering this case (a site with a self-signed cert for
which no browser is going to have a root certificate)?

Or do you think browsers should not even bother trying to warn
users about sites with self-signed certs? (That is, just treat
them as they would an unsecure site without any cert.)

  --Mike

-- 
Michael(tm) Smith
Opera Software, Tokyo
xmpp:smith@sideshowbarker.net