[junon]

I know you're being downvoted for the tone, but I agree entirely. Security is not something to sacrifice to gain less angry users. I do agree, however, with the sentiment that the UX surrounding security leaves a lot to be desired. In most cases we train users to ignore or work around security problems - we don't give them tools to solve and embrace them.

[pittmajp]

Disagree with your disagree. I understand there’s a recession and security people have to justify their salaries.

The most secure system imaginable is for your users to shut their computers and go outside. If you can’t provide security without usability, your system is worthless.

The truth is that users want products that feel secure, rather than products that are secure.

[junon]

This is a misguided and incorrect assessment except for your second point, IMO.

[ocdtrekkie]

Here's the thing: Expired certificate warnings reduce security. Because they're excessively dramatic about a routine non-issue, people learn to ignore and bypass them. Now people won't head real certificate warnings.

Unfortunately, the browser security nerds don't understand human psychology, and are more scared of the fact an expired cert can't be revoked (a nearly pointless edge case) versus users ignoring all cert warnings entirely, which they do now. A classic example of engineers who don't understand their users.

[junon]

We agree on this.

[lelanthran]

> Security is not something to sacrifice to gain less angry users.

Of course it is - it depends on Capital-C-Context.

Sure, for the bank, the site you are supplying your credit card details, your email, etc - security is non-negotiable.

For hackernews, for reddit, and for similar sites, then security is something to sacrifice, once again depending on context.

I've trusted this certificate for the last 2, maybe 3 years. It's unreasonable to assume that 5 minutes past midnight on the expiry date, the cert turned from "completely trustworthy" to "100% certainty that this is a phish, scam or similar".

We live in the real world. Things happen.

[junon]

I literally just said that I agree the UX is poor. Did you read my comment?

[lelanthran]

> I literally just said that I agree the UX is poor. Did you read my comment?

But I agree with that comment. The one I disagreed with is:

> Security is not something to sacrifice to gain less angry users.

Maybe I should rephrase (I'm a notoriously poor communicator) ...

Sometimes (like in the cases I pointed out), the security messages and warnings must be sacrificed because the practical security either doesn't matter (like hackernews) or hasn't been compromised (like the 5m after midnight example).

[junon]

Swallowing certificate expiration is not acceptable security, no. _Something_ needs to happen. What else is there than warning the user?

That being said, I've never liked how certificates are designed to begin with. They're overly complicated for very little gain IMO.