EECE 412 Term Project: A Study on SSL Warning Effectiveness

Abstract—The Secure Sockets Layer (SSL) protocol employes certificates in order to initiate a secure communication channel between the client PC and a web server. Malicious attackers in order to extract personal-sensitive information from other users may set up environments that aim at luring the users into providing their information thinking that they are using a secure channel of communication. In order for malicious attackers to achieve that, forged certificates must be used in order to initiate a SSL session and trick the user into thinking that he is dealing with a legitimate site. In an effort to fight back such attacks browser developers have created SSL warnings that are presented to the user whenever the server certificate seems to be either misconfigured or not issued by a trusted authority. These warning are designed to give the choice to the user to proceed as there are too many legitimate web sites on the web that have misconfigured certificates. It is observed that users tend to disregard those warnings for various reasons rendering them unable to serve their purpose of protecting the user from malicious phishing attacks. Our term project’s goal is to determine the reasons behind users ’ disregard to SSL warnings as well as to conclude on actions that should be taken, in future SSL warning development, in order to make them more effective in protecting users. In order to achieve this we conducted a user study in a controlled laboratory environment where we studied the reactions and reasonings of users when presented with a SSL warning while trying to access critical and non critical information on line. Index Terms—Computer Security, SSL, Warnings