11

I recently had a thought about the way many modern browsers display information about a site's security certificates. At least Firefox shows a very noticeable blue box in the address bar on sites that have valid SSL certificates, and practically all browsers give an even more visual cue on sites with more expensive EV SSL certificates.

My theory is that a company can force SSL on their website to subconsciously appear more trustworthy, even though the certificate has nothing to do with the credibility of the company itself. Is there any research to either back or refute this? If not, are there any examples of a company website that is available through both HTTP and HTTPS?

Improve this question
2
  • @Pekka: Thanks, maybe ux would indeed be better suited for this question. Can someone migrate this?
    – Kaivosukeltaja
    Oct 8 '11 at 19:09
  • I flagged it. --
    – Pekka
    Oct 8 '11 at 19:13
18

While some internet marketeers have stated that the appearance of being more secure can have a measurable effect on sale completions, I doubt that this would matter for sites that aren't directly selling something.

You also have to keep in mind that HTTPS connections are slower than HTTP, and so people will likely find your site slower. Amazon found that even a load time increase of 0.2 seconds had a measurably higher falloff rate (people leaving the page).

In the end it is weighing up whether the perceived additional benefit on your particular site would outweigh the speed sacrifice.

Of course the way to do this is with A/B testing. No opinion matters more in this case than that of your customers, and no voting more accurate than voting with their money.

As a side note: Gmail originally defaulted to HTTP but changed to HTTPS for security reasons. If your site has sensitive data, I would recommend HTTPS.

Improve this answer
7
  • 2
    "HTTPs connections are slower than HTTP" - partly, yes, but it depends and can be addressed using server-side measures. See HTTP vs HTTPS performance
    – Pekka
    Oct 8 '11 at 20:27
  • 1
    @Pekka: From what I can see they are always slower. In some situations only a little slower, but always slower. Even Google claims that using HTTPS on their services will make things slower - and they are one of the most speed conscious companies out there.
    – JohnGB ♦
    Oct 8 '11 at 21:25
  • 6
    @Fiasco a halfway modern CPU is able to decrypt SSL without even blinking - that shouldn't be much of an obstacle. But it seems to be the handshake that initiates the connection that is indeed taking a lot of time, so +1 to JohnGB
    – Pekka
    Oct 8 '11 at 22:41
  • 1
    "In the end it is weighing up whether the perceived additional benefit on your particular site would outweigh the speed sacrifice." Well, no. In the end it's whether what you're running over SSL needs to be encrypted. Anything carrying an authenticated session (or obviously credit card data, PII, etc) that could potentially be hijacked should be run over SSL. Google 'Firesheep' for reasons why. Sure, SSL is a little slower, but let's see how much product you sell when your users get pwned because of poor security practices on your part.
    – snipe
    Dec 5 '11 at 19:04
  • 1
    @snipe: nobody anywhere was questioning using SSL for secure transactions. The question was about using it on the entire website.
    – JohnGB ♦
    Dec 6 '11 at 10:26
6

If I'm not mistaken, you get all kinds of problems with HTTPS pages, in addition to the performance issues brought up by @JohnGB: you have more difficulties linking to internal pages, some browsers pop the "entering/leaving encrypted webpage" whenever people enter/leave your website, you get problems with images and scripts from external sources etc. The hypothetical increase in perceived credibility is just not worth all the mess for you and your users.

Improve this answer
3
  • 1
    +1 for pointing out the additional pitfalls in HTTPS.
    – JohnGB ♦
    Oct 9 '11 at 14:59
  • This is a non-issue and is easily solved by either mirroring your regular site to your HTTPS and using "/" as your root url (so SSL loads SSL items, non-SSL loads non-SSL items). Most browsers will only give the "entering/leaving encrypted" text if the user has stricter security settings. The real question is not whether the reputation enhancement is worth the hassle, it is whether or not encryption is actually needed. If there is no PII, no session management/login, the answer is probably no. If there is, the answer is absolutely yes.
    – snipe
    Dec 5 '11 at 19:12
  • @snipe: The fact that these issues are easily addressed (for most sites; it's probably a big hassle to address them in some older sites) doesn't prevent them from being issues. However, non of these concerns are UX concerns.
    – Brian
    Jul 25 '13 at 20:47
4

I am not sure how much a company can "enhance its reputation" by using https - to apply for a certificate, you need to show that you are a secure company. It does reflect that a company is not just a fly-by-night organisation.

Extended SSL certificates require even more verification - they are good if you can get them, and do indicate a degree of trustworthyness, becasue they indicate that the the company has been around for a while.

But it is slower, and requires more processing on the server. A slower site is a bad thing, and a slower home page is a definate turn off - if it is slower, then people are liable to disappear without knowing anything about the site. More server processing is an issue where companies do not want to spend more on hardware ( and companies who don't care about server cost, are probably not going to need to resort to these measures ).

So, overall, there does not seem to be any real benefit to doing this. There is a benefit in getting the best SSL you can get, but trying to use it across a site is a bad idea, and companies that try this are as likely to have other problems.

Improve this answer
2
  • "It does reflect that a company is not just a fly-by-night organisation." No, it doesn't. Most SSL certificate vendors will issue them within moments with no need to verify anything. The only SSL certs that actually require any real proof of anything are EV (Extended Validation) certs. en.wikipedia.org/wiki/Extended_Validation_Certificate
    – snipe
    Dec 5 '11 at 19:10
  • Users have been trained to be wary of sites which perform transactions without SSL. Users do tend to prefer EV certificates over non-EV certificates. However, I suspect this is because browsers tend to use friendlier graphics for EV certificates (e.g., greens instead of yellows), rather than because users actually understand the difference between an EV certificate and a normal certificate.
    – Brian
    Jul 25 '13 at 20:45
3

In terms of credibility - yes SSL appears more secure. The problem is it can be faked as pointed out in the following article:

The SANS Institute's Internet Storm Center noted the scam, and advised its users that "it is not possible to identify fake or real websites by the lock icon alone. ... While you can assure that the session is encrypted, it is not possible to ensure that this is the real organization." Scammers can also configure their web server so that deceptive SSL certificates won't trigger an alert in the user's browser. "One of the SSL encoding methods is 'plain text'," Neal Krawetz from Secure Science Corporation noted in the SANS post on the issue. "Most SSL servers have this disabled by default, but most browsers support it. When plain text is used, no central certificate authority is consulted and the user never sees a message asking if a certificate should be accepted (because 'plain text' doesn't use certificates). Keeping that in mind, the little lock icon may not even indicate an encrypted channel. The little lock only indicates an SSL connection." A technique called visual spoofing offers another method to present a "lock" to visitors on a Scam phishing site. The technique alters the user interface of the web browser, substituting images for parts of the browser interface that would normally help users detect the fraud. Javascript links launch a new browser window without scrollbars, menubars, toolbars and the status bar - which allows the scam artists to substitute a fake status bar containing the URL for a legitimate site, along with an image of a "lock" indicating a secure SSL site.

So, it can make your site appear more credible but this can be faked as well. Do most people know this, probably not. They might feel more secure if it is used, but what they don't know is that they could be getting tricked. In terms of your bottom line, you should use it.

Think of the use of ATMs. People feel secure using their PIN numbers to access their account. Can this number be stolen/recorded from the machine they are using and used elsewhere? Absolutely, but they still feel safe with the current method.

Improve this answer
0

It's an OLD post above but will give my view in oct 2013 as it's still ranking highly. IMO an SSL does give credit. As a consumer I would not 'buy' anything from a site that did not use SSL. Things have changed since posts above. Many SSL suppliers provide coding used on your website linking to theirs showing your business details and confirming you are legitimate. Most browsers on first load of SSL site will tell you about the SSL certificate. You would find it difficult to find any reputable website selling any product or service in today's world without an SSL. The only time I would not use a SSL if for a normal website that does not sell or require any sign up or use personal details.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.