On Sep 13, 2011, at 2:22 28PM, Andy Steingruebl wrote: > On Tue, Sep 13, 2011 at 10:48 AM, Steven Bellovin <s...@cs.columbia.edu> > wrote: > >> Furthermore, >> they're probably right; most of the certificate errors I've >> seen over the years were from ordinary carelessness or errors, >> rather than an attack; clicking "OK" is *precisely* the right >> thing to do. > > Is anyone aware of any up-to-date data on this btw? I've had > discussions with the browser makers and they have some data, but I > wonder whether anyone else has any data at scale of how often users > really do run into cert warnings these days. They used to be quite > common, but other than 1 or 2 sites I visit regularly that I know ave > self-signed certs, I *never* run into cert warnings anymore. BTW, > I'm excluding "mixed content" warnings from this for the moment > because they are a different but related issue.
>From personal experience -- I use https to read news.google.com; Firefox 6 on a Mac complains about wildcard certificates. And ietf.org's certificate expired recently; it took a day or so to get a new one installed. --Steve Bellovin, https://www.cs.columbia.edu/~smb _______________________________________________ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography