Will You Trust This TLS Certificate? Perceptions of People Working in IT

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F19%3A00111065" target="_blank" >RIV/00216224:14330/19:00111065 - isvavai.cz</a>

Výsledek na webu

<a href="http://dx.doi.org/10.1145/3359789.3359800" target="_blank" >http://dx.doi.org/10.1145/3359789.3359800</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1145/3359789.3359800" target="_blank" >10.1145/3359789.3359800</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Will You Trust This TLS Certificate? Perceptions of People Working in IT

Popis výsledku v původním jazyce

Flawed TLS certificates are not uncommon on the Internet. While they signal a potential issue, in most cases they have benign causes (e.g., misconfiguration or even deliberate deployment). This adds fuzziness to the decision on whether to trust a connection or not. Little is known about perceptions of flawed certificates by IT professionals, even though their decisions impact high numbers of end users. Moreover, it is unclear how much does the content of error messages and documentation influence these perceptions. To shed light on these issues, we observed 75 attendees of an industrial IT conference investigating, different certificate validation errors. Furthermore, we focused on the influence of re-worded error messages and redesigned documentation. We find that people working in IT have very nuanced opinions regarding the tested certificate flaws with trust decisions being far from binary. The self-signed and the name constrained certificates seem to be over-trusted (the latter also being poorly understood). We show that even small changes in existing error messages and documentation can positively influence resource use, comprehension, and trust assessment. Our conclusions can be directly used in practice by adopting the re-worded error messages and documentation.

Název v anglickém jazyce

Will You Trust This TLS Certificate? Perceptions of People Working in IT

Popis výsledku anglicky

Flawed TLS certificates are not uncommon on the Internet. While they signal a potential issue, in most cases they have benign causes (e.g., misconfiguration or even deliberate deployment). This adds fuzziness to the decision on whether to trust a connection or not. Little is known about perceptions of flawed certificates by IT professionals, even though their decisions impact high numbers of end users. Moreover, it is unclear how much does the content of error messages and documentation influence these perceptions. To shed light on these issues, we observed 75 attendees of an industrial IT conference investigating, different certificate validation errors. Furthermore, we focused on the influence of re-worded error messages and redesigned documentation. We find that people working in IT have very nuanced opinions regarding the tested certificate flaws with trust decisions being far from binary. The self-signed and the name constrained certificates seem to be over-trusted (the latter also being poorly understood). We show that even small changes in existing error messages and documentation can positively influence resource use, comprehension, and trust assessment. Our conclusions can be directly used in practice by adopting the re-worded error messages and documentation.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

—

Návaznosti

S - Specificky vyzkum na vysokych skolach

Rok uplatnění

2019

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Proceedings of the 35rd Annual Computer Security Applications Conference

ISBN

9781450376280

ISSN

—

e-ISSN

—

Počet stran výsledku

14

Strana od-do

718-731

Název nakladatele

Association for Computing Machinery

Místo vydání

New York, NY, USA

Místo konání akce

San Juan, Puerto Rico, USA

Datum konání akce

9. 12. 2019

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

000540643900055