Making SSL Warnings Work

on YouTube ↗52m

" summary

Chrome instruments real errors and targets fixes not handwavy examples: browser detects client clocks cause ~20% of HSTS errors, shows a date‑settings flow; captive portals trigger ~4.5% of SSL errors and get a connect flow; intermediate root mishaps get automated remediation plans. Redesign makes the safe choice prominent and doubles caution so field trials show ~62% adherence to “back to safety”. The approach is specific measurable fixes plus UI nudges and some problems remain unsolvable without ecosystem changes.

AI-written summary · about

" chapters (5)

1. 0:00The perfect security warning
2. 2:55Reducing false positives
3. 16:39Improving user comprehension
4. 27:48Opinionated design
5. 33:30Conclusion and Q&A

" related talks

• 41mhttps://*every site here*Emily Stark · OWASP AppSec California 2016
• 29mBrowser Security in 2017Johann Hofmann · JSUnconf 2017
• 58m25 Years of SSL - Secure(ish) Sockets LayerScott Helme · NDC TechTown 2020
• 37mHTTPS Is Better than Ever Before. Now Its Your Turn.Jim Manico · OWASP AppSec Research (AppSecEU) 2015
• 51mWeb Platform: The Secure PartsMike West · GOTO Aarhus 2013
• 53mHansel and Gretel do TLSMarcus Bointon · International PHP Conference Spring 2019
• 53m25 Years of SSL - Secure(ish) Sockets LayerScott Helme · NDC Security Oslo 2020
• 40mWebsite security 101Per Thorsheim · QA Fest 2016