Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

We were discussing the usage of https on our company website, at least in the checkout process. Since we are already using a cloudflare business plan, I suggested running tests and turning on their ssl feature. One of my colleges insisted that users would consider it strange or even troubling when the 'green lock' displayed in the browser showed to be signed by Cloudflare, instead of [Company Name].

Have you run - or have you read about - any user testing on ssl signing?

share|improve this question
4  
A great question. This represents the disconnect between function and perception quite nicely. For those in the know, SSL stands for confidentiality and integrity. For the majority of users SSL is their trust mechanism - they don't know why it is there and they often wouldn't miss it but if there is a mismatch as you describe, they may get bent out of shape. –  Gusdor Aug 6 '13 at 8:23
1  
While many users may not care or notice, in a corporate environment where enterprise software selection is centralized, your application may never get in front of any users unless it first passes muster with those with the job of ensuring the enterprise is operating securely. –  codingoutloud Aug 6 '13 at 20:54

5 Answers 5

I was curious about this, so I did an Association for Computing Machinery (ACM) search and turned up articles stating that users often don't notice the https or the padlock. There is also a branch of corporate training devoted to ensuring that employees don't fall prey to phishing attacks. I took one of these courses at a former employer.

Here's a study: Sheng, Holbrook, Kumaraguru et al found in a survey of 1001 respondents that women were more susceptible than men to fall prey to phishing, and people 18-25 are more susceptible than other age groups. After educating users about the dangers, users were slightly less likely to click on legitimate websites, cited in "Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions".

share|improve this answer
    
By ACM, do you mean the Association for Computing Machinery? –  Charles Wesley Aug 5 '13 at 22:58
    
Yes I do. Sorry for making you guess! –  LindaBrammer Aug 6 '13 at 1:58

You could try overcome the problem Cloudflare vs [Company Name] by putting a prominent note in the top of page, near https lock in address bar:

Transaction is secured by Cloudflare, learn more...

This note also accents operation's security explicitly.

In my practice of observing (not massive though) non-tech users, they are not paying attention to the https at all, their attention is inside the page. I remember only a case when SSL certificate was expeired and browser showed appropriate message which broke task flow and rised question from user.

share|improve this answer
2  
No, the transaction is not secured by Cloudflare. Only the HTTP connection is. The transaction from a user perspective is the financial transaction between consumer and merchant. –  Mathew Foscarini Aug 6 '13 at 16:54
    
Sorry, I meant just make it prominent so those who care could easy read and understand "Cloudflare vs [Company Name]" problem. –  Alexey Kolchenko Aug 6 '13 at 18:16

I think you should instead ask "do your customers care about https?" Different demographic groups are likely to have different sensitivities.

I would also weigh this against how you position your brand and what you think best practice is in your industry. On a security issue like this, I would tend to favor adoption of https as a reflection of company security policy or brand positioning over any user preference, unless there was a strong aversion to the practice.

share|improve this answer

IMO it's not what the users want but what the IT pros think that is good for them.
You have to solve the security problem, it doesn't matter how but you (the company) has to rest sure that it's not putting its customers to risk.
The more the users trust you, the less they will care about the details (that's how trust works).
If you fail then all the trust will vanish in the time needed for bad news to travel through the internet.
This is another application of do what they need, not what they want.
If you run a poll the outcome might be that they don't care about https. You should do, https or whatever, in order not to flop on the security side.

share|improve this answer

Many users use the presence of SSL to determine if a site that is unfamiliar is a legitimate business or not. This is similar to having a phone number that starts with 800 for your business. The certificate by owned by cloudflare would be like the phone number being provided by At&t.

In fact, these are two anti phishing tips sent by banks and companies like eBay.

share|improve this answer
    
Also, SSL does help prevent security breaches by making it way harder to eavesdrop. –  Owen Johnson Aug 7 '13 at 13:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.