Very good point. Indeed there is a great need to ...

2009-10-14T21:27:10.289-05:00

Very good point. Indeed there is a great need to educate users on what to watch out for. I think at one point Moxie even mentions injecting a "padlock" favicon.ico to further trick the user into thinking that they're on a secure connection. Most users I know would probably fall for that.

I suppose that's true, but in the same breath,...

2009-10-14T19:56:13.894-05:00

I suppose that's true, but in the same breath, he's essentially pointed out why the attack against SSL *doesn't* work: the user is signalled that the connection is insecure (by various means: a missing padlock icon, a lack of https in the URL, a non-green address bar in IE8). What he's highlighting is a lack of user-education; users don't understand https in general.

I don't think this is a fundamental failure of browsers, but it is something that browsers need to do a better job of: alerting users that their connection is insecure. It's difficult to strike a balance between notifying users on the one hand and annoying users on the other (as witnessed by the annoyance of UAC in Windows Vista). How do you unobtrusively alert users when they're about to do something dangerous?

Comments on Brian Hall: The Broken Web Browser Model

Very good point. Indeed there is a great need to ...

I suppose that's true, but in the same breath,...