Will You Trust This TLS Certificate? Perceptions of People Working in IT (Extended Version)
Martin Ukrop, Lydia Kraus, Vashek Matyas

TL;DR
This study explores how IT professionals perceive flawed TLS certificates, revealing nuanced trust decisions influenced by error message wording and documentation, with implications for improving security communication.
Contribution
It provides new insights into IT professionals' perceptions of flawed TLS certificates and demonstrates how message rewording can improve trust assessment and resource use.
Findings
IT professionals have nuanced trust decisions, not binary.
Self-signed and name-constrained certificates are often over-trusted.
Small changes in error messages improve understanding and trust.
Abstract
Flawed TLS certificates are not uncommon on the Internet. While they signal a potential issue, in most cases they have benign causes (e.g., misconfiguration or even deliberate deployment). This adds fuzziness to the decision on whether to trust a connection or not. Little is known about perceptions of flawed certificates by IT professionals, even though their decisions impact high numbers of end users. Moreover, it is unclear how much the content of error messages and documentation influences these perceptions. To shed light on these issues, we observed 75 attendees of an industrial IT conference investigating different certificate validation errors. We also analyzed the influence of reworded error messages and redesigned documentation. We find that people working in IT have very nuanced opinions, with trust decisions being far from binary. The self-signed and the name-constrained…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
