A Week to Remember: The Impact of Browser Warning Storage Policies
A Week to Remember: The Impact of Browser Warning Storage Policies
复制标题
值得记住的一周：浏览器警告存储策略的影响
DOI：
--
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
A. Felt
中科院分区：
文献类型：
--
作者：
J. Weinberger;A. Felt
当有人决定忽略HTTPS错误警告时，浏览器应该记住这个决定多长时间？如果他们在五分钟、一小时、一天或一周后返回网站，浏览器应该再次向他们显示警告还是尊重他们之前的决定？目前还没有明确的行业共识，八种主要的浏览器展示了四种不同的HTTPS错误异常存储策略。理想情况下，浏览器不会一遍又一遍地向某人询问相同的警告。如果用户认为警告是错误的警报，重复的警告会破坏浏览器的可信度，而不会提供安全益处。然而，有些人可能会改变主意，我们不希望一个安全错误成为永久性的。我们评估了六个存储政策的大规模，多个月的现场实验。我们发现这些策略之间存在很大的差异，其中一个存储策略比其他策略更能实现我们的目标。Google Chrome 45采用了我们的建议，并且自部署以来已经证明是成功的。随后，我们运行了Mechanical Turk和Google消费者调查，以了解用户对警告的期望。受访者普遍对Chrome的新存储策略缺乏了解，但我们仍然对我们的建议感到满意，因为我们在现场观察到了行为上的好处。
When someone decides to ignore an HTTPS error warning, how long should the browser remember that decision? If they return to the website in five minutes, an hour, a day, or a week, should the browser show them the warning again or respect their previous decision? There is no clear industry consensus, with eight major browsers exhibiting four different HTTPS error exception storage policies. Ideally, a browser would not ask someone about the same warning over and over again. If a user believes the warning is a false alarm, repeated warnings undermine the browser’s trustworthiness without providing a security benefit. However, some people might change their mind, and we do not want one security mistake to become permanent. We evaluated six storage policies with a large-scale, multimonth field experiment. We found substantial differences between the policies and that one of the storage policies achieved more of our goals than the rest. Google Chrome 45 adopted our proposal, and it has proved successful since deployed. Subsequently, we ran Mechanical Turk and Google Consumer Surveys to learn about user expectations for warnings. Respondents generally lacked knowledge about Chrome’s new storage policy, but we remain satisfied with our proposal due to the behavioral benefits we have observed in the field.