AppSec California 2015

HTTPS is an important tool for protecting the privacy of online communication. However, SSL warnings are a weak point in this system. Often, the browser can't tell whether a certificate validation error is indicative of an attack or a simple server misconfiguration. The user is asked to decide what to do, even though s/he probably isn't equipped to make that decision. My team is trying to make SSL warnings more effective (and helpful) in Chrome. In this talk, I'll describe how we're trying to automatically identify and resolve common sources of false positive warnings. I'll also discuss how we redesigned SSL warnings to be more understandable by end users.