Hacker News new | ask | show | jobs
by SturgeonsLaw 1251 days ago
> there should be a way to use TLS with a self-signed cert

Well, there is, all (afaik) current browsers have some kind of barely visible "yeah, I know, take me there any way" button buried under a click or two on those cert error screens. The only exception to this that I can recall are servers that use an old version of TLS like 1.0, and in those cases, there is a browser flag that lets them load.
1 comments
entropyie 1251 days ago
Sure, what I had in mind was a more user-friendly UX. For example, if I could add something to the certificate subject to say: "This is an obfuscation only cert, not claiming identity or MITM resistance".

Then, the browser would either show the address bar like a HTTP page, or maybe show a notification instead of a block page, saying: "This is the first time you have visited this page. Identity is not verified. Trust identity?"

You can tell I don't do UX for a living ;-)

link
iso1631 1251 days ago
For 90% of people there's two UI options

1) a button to let them get where they want to go

2) A button which doesn't let them get where they want to go

link
jeroenhd 1251 days ago
> "This is the first time you have visited this page. Identity is not verified. Trust identity?"

Users will click random buttons until the popup disappears. You can watch it happen in real time when you help the elderly with computer issues and don't say anything. Every option from cancel to close to OK is tried as whatever is happening doesn't work. Reading the error message itself is an action of last resort.

There's a good reason you can only bypass certain TLS errors by typing "thisisunsafe" into the error screen in Chrome; people just clicked the ignore button until the problem disappeared and then ran into trouble.

link