"I Have No Idea What I'm Doing" - On the Usability of Deploying HTTPS
summary
Lab usability study with 28 knowledgeable participants and follow-up interviews with 7 security auditors observes configuring HTTPS on Apache as surprisingly error-prone: only 4 A grades, 15 B grades, 4 participants failing to deploy a valid config. Participants visit ~60 web pages on average, often copy outdated tutorials, struggle with Apache file structure and CSR/PEM/CRT differences, and neglect hardening steps; 14 enable forward secrecy, 11 set HSTS, two try HPKP, all use RSA >=2k. Evaluation uses Qualys SSL Labs and nmap plus manual config inspection.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:05Motivation and Goals
- 3:58Let's Encrypt
- 4:29Methodology - Data Collection
- 7:01Data Analysis
- 7:44Security Evaluation
- 11:49Online Sources
- 14:25Impact of prior experience
- 14:53Confusing File Structure and Terminology
- 16:00More Usability Challenges
- 17:12Interviews with Security Auditors
- 18:38Configurations in the Wild
- 20:29Compatibility
- 21:42Suggested improvements
- 27:47Conclusions
related talks
59mProactively defending your business
40mWebsite security 101
53mI Wanna Deploy You, but My Senses Tell Me to ...
37mHTTPS Is Better than Ever Before. Now Its Your Turn.
42mLet's go HTTPS
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
52mMaking SSL Warnings Work
36mHTTPS Is Not Enough