Study proves security certificate warnings don't work

Every web surfer has seen them. Those 'invalid certificate' warnings you sometimes get when you're trying to visit a secure website.

They say things like "there is a problem with this website's security certificate".

If you're like most people, you may feel vaguely uneasy, and - according to a new paper from researchers at Carnegie Mellon University - there's a good chance you'll ignore the warning and click through anyway.

In a laboratory experiment, researchers found that between 55 percent and 100 percent of participants ignored certificate security warnings, depending on which browser they were using (different browsers use different language to warn their users).

"Everyone knew that there was a problem with these warnings," said Joshua Sunshine, a Carnegie Mellon graduate student and one of the paper's co-authors. "Our study showed dramatically how big the problem was."

That's not great news. Often the warnings pop up because of a technical problem on the website, but they can also mean that the web surfer is being redirected somehow to a fake website. URLs for secure websites begin with 'https'.

The researchers first conducted an online survey of more than 400 web surfers, to learn what they thought about certificate warnings. They then brought 100 people into a lab and studied how they surf the web.

They found that people often had a mixed-up understanding of certificate warnings. For example, many thought they could ignore the messages when visiting a site they trust, but that they should be more wary at less-trustworthy sites.

"That's sort of a backwards understanding of what these messages mean," Sunshine said. "The message is validating that you're visiting the site you think you're visiting, not that the site is trustworthy."

If a banking website shows a message that its security certificate is invalid, that's a very bad sign, security experts say. It could mean the web surfer is being subjected to a so-called man-in-the-middle attack. In this type of attack, the criminal inserts himself between the web surfer and the site he's visiting, in the hopes of stealing information.

Security experts have long known that these security warnings are ineffective, said Jeremiah Grossman, chief technology officer with web security consultancy White Hat Security. That's because users "really don't know what the security risks mean", he said. "So they take the gamble."

In Firefox 3, Mozilla tried to use simpler language and better warnings for bad certificates. And the browser makes it harder to ignore a bad certificate warning. In the Carnegie Mellon lab, Firefox 3 users were the least likely to click through after being shown a warning.

The researchers experimented with several redesigned security warnings they'd written themselves, which appeared to be even more effective. They plan to report their findings August 14 at the Usenix Security Symposium in Montreal.

Still, Sunshine believes that better warnings will help only so much. Instead of warnings, browsers should use systems that can analyze the error messages. "If those systems decide this is likely to be an attack, they should just block the user altogether," he said.

Even when visiting important websites like banks, "people are still dramatically ignoring the warnings," he said.

Submit to:Digg Slashdot Del.icio.us Reddit

• FREE email newsletters. Get news, reviews and features straight to your inbox
• For videos of the latest products, visit PC Advisor TV
• Sign up for RSS to get the latest news and reviews, direct to your desktop
• Get PC Advisor news, reviews and blogs on your website for free

Latest technology news:

• British Library to offer 65,000 free ebooks in Amazon deal
• More companies look to virtualisation says Citrix
• Antivirus programs fail to stop new malware
• NASA's Endeavour blasts off on last mission to space station
• Toyota in Prius global recall after braking software fault