HOW TO tell if you're designing an insecure site
summary
Claim: visual design can make a site feel secure while leaking credentials and trust. Demonstrations include a Gmail favicon bookmark phishing proof of concept, a walk-through showing password reset via email is unauthenticated (browser → server → out‑of‑band email), and citations of research creating rogue SSL certificates bypassing browser warnings and the limits of EV indicators. Notes cover browser UI quirks, mixed‑content problems, and why these concrete failures matter for real deployments.
AI-written summary · about
chapters (8)
- 0:00Insecure design signs
- 2:04Design vs security trade-offs
- 6:27Phishing attacks and trust
- 11:28Visual cues and user assumptions
- 20:25Password reset flaws
- 27:17SSL limitations
- 33:20Usability vs security
- 35:19Q&A
related talks
29mSecurity by(e) Design?
28mSecurity Through Design - Making Security Better By Designing for People
46mDesigning Like a Hacker
01h 03mWhy Don't Users Do What They are Supposed to Do? A look at users and security
29mSecurity is not a Feature!
59mProactively defending your business
49mSecurity and Insecurity of HTTP Headers
41mSecurity: The world is broken and you are guilty