- From: Thomas Roessler <tlr@w3.org>
- Date: Fri, 12 Oct 2007 18:51:47 +0200
- To: Ian Fette <ifette@google.com>
- Cc: Serge Egelman <egelman@cs.cmu.edu>, yngve@opera.com, Johnathan Nightingale <johnath@mozilla.com>, W3C WSC Public <public-wsc-wg@w3.org>
On 2007-10-12 09:29:56 -0700, Ian Fette wrote: >> Of the number of sites that yield warnings for this (where the >> certificate was granted for the domain, but the subdomain >> doesn't match), how many are malicious? How many times is it >> benign when this warning appears? > The point isn't how many of these such sites are currently > malicious. Well, if you want to consider the habituation effect that occurs, a warning that mostly cries wolf is significantly worse than one that's mostly right. In particular, if a warning mostly occurs under legitimate circumstances, the attack vector might not even be new. The question is really whether the survey that Johnathan was citing (i.e., current warnings have an effect in something like 40% of all cases) is right, or whether the assumption is right that the current warnings are largely ignored. -- Thomas Roessler, W3C <tlr@w3.org>
Received on Friday, 12 October 2007 16:51:55 UTC