Web users are shown an invalid certificate warning
when their browser cannot validate the identity of
the websites they are visiting. While these warnings
often appear in benign situations, they can also
signal a man-in-the-middle attack. We conducted a
survey of over 400 Internet users to examine their
reactions to and understanding of current SSL warnings.
We then designed two new warnings using warnings
science principles and lessons learned from the
survey. We evaluated warnings used in three popular
web browsers and our two warnings in a 100-
participant, between-subjects laboratory study. Our
warnings performed significantly better than existing
warnings, but far too many participants exhibited
dangerous behavior in all warning conditions. Our results
suggest that, while warnings can be improved,
a better approach may be to minimize the use of SSL
warnings altogether by blocking users from making
unsafe connections and eliminating warnings in benign
situations