15

We were discussing the usage of https on our company website, at least in the checkout process. Since we are already using a Cloudflare business plan, I suggested running tests and turning on their SSL feature. One of my colleagues insisted that users would consider it strange or even troubling when the 'green lock' displayed in the browser showed to be signed by Cloudflare, instead of [Company Name].

Have you run - or have you read about - any user testing on SSL signing?

3
  • 4
    A great question. This represents the disconnect between function and perception quite nicely. For those in the know, SSL stands for confidentiality and integrity. For the majority of users SSL is their trust mechanism - they don't know why it is there and they often wouldn't miss it but if there is a mismatch as you describe, they may get bent out of shape.
    – Gusdor
    Aug 6, 2013 at 8:23
  • 1
    While many users may not care or notice, in a corporate environment where enterprise software selection is centralized, your application may never get in front of any users unless it first passes muster with those with the job of ensuring the enterprise is operating securely. Aug 6, 2013 at 20:54
  • Actually, there is no need to discuss this as multiple countries have implemented the usage of SSL/TLS as necessary by law.
    – marvinpoo
    Sep 29, 2020 at 12:54

5 Answers 5

11

I was curious about this, so I did an Association for Computing Machinery (ACM) search and turned up articles stating that users often don't notice the https or the padlock. There is also a branch of corporate training devoted to ensuring that employees don't fall prey to phishing attacks. I took one of these courses at a former employer.

Here's a study: Sheng, Holbrook, Kumaraguru et al found in a survey of 1001 respondents that women were more susceptible than men to fall prey to phishing, and people 18-25 are more susceptible than other age groups. After educating users about the dangers, users were slightly less likely to click on legitimate websites, cited in "Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions".

4
  • By ACM, do you mean the Association for Computing Machinery? Aug 5, 2013 at 22:58
  • Yes I do. Sorry for making you guess! Aug 6, 2013 at 1:58
  • Thanks for sharing the study! One thing to note is this study is ten years old now. With security breaches in the news and browsers putting more focus on security I would wonder if the public has changed....
    – Benjamin S
    Sep 29, 2020 at 14:43
  • I'd say that things have changed so much in terms of what is accepted practice in the last 7 years that all the 2013 responses on this thread are seriously out of date.
    – PhillipW
    Sep 29, 2020 at 17:47
5

You could try overcome the problem Cloudflare vs [Company Name] by putting a prominent note in the top of page, near https lock in address bar:

Transaction is secured by Cloudflare, learn more...

This note also accents operation's security explicitly.

In my practice of observing (not massive though) non-tech users, they are not paying attention to the https at all, their attention is inside the page. I remember only a case when SSL certificate was expeired and browser showed appropriate message which broke task flow and rised question from user.

2
  • 2
    No, the transaction is not secured by Cloudflare. Only the HTTP connection is. The transaction from a user perspective is the financial transaction between consumer and merchant.
    – Reactgular
    Aug 6, 2013 at 16:54
  • Sorry, I meant just make it prominent so those who care could easy read and understand "Cloudflare vs [Company Name]" problem. Aug 6, 2013 at 18:16
3

I think you should instead ask "do your customers care about https?" Different demographic groups are likely to have different sensitivities.

I would also weigh this against how you position your brand and what you think best practice is in your industry. On a security issue like this, I would tend to favor adoption of https as a reflection of company security policy or brand positioning over any user preference, unless there was a strong aversion to the practice.

1

IMO it's not what the users want but what the IT pros think that is good for them.
You have to solve the security problem, it doesn't matter how but you (the company) has to rest sure that it's not putting its customers to risk.
The more the users trust you, the less they will care about the details (that's how trust works).
If you fail then all the trust will vanish in the time needed for bad news to travel through the internet.
This is another application of do what they need, not what they want.
If you run a poll the outcome might be that they don't care about https. You should do, https or whatever, in order not to flop on the security side.

0

Many users use the presence of SSL to determine if a site that is unfamiliar is a legitimate business or not. This is similar to having a phone number that starts with 800 for your business. The certificate by owned by cloudflare would be like the phone number being provided by At&t.

In fact, these are two anti phishing tips sent by banks and companies like eBay.

1
  • Also, SSL does help prevent security breaches by making it way harder to eavesdrop. Aug 7, 2013 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.