We're getting a bit off topic here, but this stuff is important (the extension won't work but other approaches that convert the web app into something you "install" might do).
The 60% figure comes from the Chrome developers and I believe it's the total of all displayed interstitials.
I don't understand why you think self-signed certs provide any security. It isn't "easier" to do a MITM, it's the same as with no SSL at all. Unless you have communicated the cert to your users out of band (no first time visitors) AND they are installing the cert themselves, it provides no security.
You say you don't understand, but then you go on to say "unless you have communicated the cert" which is exactly what I'm doing, so I guess you do understand. Additonally, blockchain.info doesn't use a SS cert. I was simply using that example to show how those numbers are inflated by people like me. The number of benign SS certs that are accepted is sadly not part of that number. Even if it's half (which I doubt), 30% is still too many compromises and obviously something needs to be done to educate the users.The 60% figure comes from the Chrome developers and I believe it's the total of all displayed interstitials.
I don't understand why you think self-signed certs provide any security. It isn't "easier" to do a MITM, it's the same as with no SSL at all. Unless you have communicated the cert to your users out of band (no first time visitors) AND they are installing the cert themselves, it provides no security.
Quote
The click through rate on SSL errors for modern browsers should be zero because they don't let you click through (except for self signed certs, and even then, only with a lot of hassle). That change was made because the previous clickthrough rates were close to 100%.
I agreeQuote
Your belief that users are "dumb" if they ignore warnings is worthless because it categorizes all users as dumb, which is usually a good sign that actually your expectations are wrong. The real reason users clicked through these alerts was usually one of the following:
1) They didn't understand what the warning meant.
2) They have seen the warnings before in non-dangerous situations (like the clock being set wrong or a self signed cert).
Well I do still think most all users are dumb. Not dumb in all things, just in how this tech works. After reading the studies you have linked, I'd also add that being dumb is not prerequisite for failing to check that everything is secure as even intelligent people make mistakes. What word would you use instead of "dumb?" Clearly the users are something less than fully aware of their surroundings if they are ignoring warnings that are going to lead to them being robbed. This is not intelligent behavior.1) They didn't understand what the warning meant.
2) They have seen the warnings before in non-dangerous situations (like the clock being set wrong or a self signed cert).
In my experience, you have to treat your users like they are idiots or malicious attackers who will do everything wrong and the software still has to be 100% secure and still work. As you've pointed out, Blockchain.info sadly does not have this level of security yet, as it requires use of a secure passphrase and knowledge of two-factor auth and installation of a plugin. I still don't understand why you think the plugin is useless.
You seem to be taking the stance that it is an impossible task to trust users not to click the button "Hack me" button no matter how scary we make it. If that's true, then aren't you the one calling the users dumb?
If this is really about only promoting clients with perfect security, then I'd say that you can't promote any of the desktop clients either as they are all vulnerabile to key logging and the beloved satoshi client has difficult to manage backups. Tangent: I wonder how many coins have been lost by deleting/losing wallets compared to being stolen because of weak security.
It sounds to me like if a user is going to be unsafe with their computer and accept bad SSL certs and generally ignore any warnings that things are going bad (as the studies you have linked prove), then these people more than likely have compromised computers anyway in which case their funds in their desktop wallet are also at risk and we have saved them from nothing by getting them to fear web wallets.
The only secure solution is a hardware wallet that can interface with any client, desktop or web. Then the private keys are never anywhere that can be compromised by a hacker.
