up vote -1 down vote favorite
share [g+] share [fb]

I've seen many browsers, both mobile and desktop, show a warning dialog when I click on an HTTPS link. Just warning of the fact that this is an HTTPS link.

For example, my Nokia E75 asks "Opening a secure connection. Content cannot be seen by anyone else. Continue?"

Why do they do this, as if HTTPS was something to be avoided?

Why? Why? Why?

"Which version of browser is it?"
I've seen many different browsers do this. Any of them.

"What specific link are you following?"
It happens with any HTTPS link.

"Didn't you ask the same question recently?"
I did, but it was open to interpretation. I got some good answers back about some of things that can go wrong with HTTPS that could cause a warning. Rather that bury those answers, I re-wrote the question to fit the answer and I'm re-asking the question I really wanted to ask here.

link|improve this question
100% accept rate
Please provide desktop browser examples. – Daniel Beck Nov 6 '11 at 13:10
Haven't seen them do this in a while, but I thnk IE 5 or 6 did this. I'd always tick the "Don't ask again" box. – billpg Nov 6 '11 at 13:56
I've always explained those IE dialogs to myself that it's a gentle (and ironic) way of reminding you that you are not safe all the time out there in the wild. (But that's perhaps too speculative to become answer ;)) – Alois Mahdal Jan 22 at 5:57
feedback

3 Answers

up vote 1 down vote accepted

They want to make you aware that you are using a secure connection.

People have been trained for a while to look for "the lock icon" or something similar in desktop web browsers whenever e.g. entering credit card information when buying something, or visiting their bank's web site.

It appears from your question and comment that (aside from the "tutorial type" message you remember from older versions of IE — and really everything you did for the first time, e.g. submitting a form, was accompanied by a message like that) you notice this behavior primarily in mobile web browsers.

They have less display space to permanently display icons or EV certificate information that indicate a secure connection and therefore need to use other mechanisms, e.g. dialogs, to make you aware of this.

link|improve this answer
Just wanted to point out that when these messages are enabled, they appear both when you go from a non-secure to secure connection, and when you go from a secure to a non-secure connection. Billpg may have only noticed the "secure" message, which might seem pointless by itself. – Bavi_H Nov 6 '11 at 16:54
@bavi which aligns with my explanation: they're used instead of some permanent indicator as there's no screen real estate for those. Thanks for the information. – Daniel Beck Nov 6 '11 at 18:31
feedback
up vote 1 down vote

Not an answer, just some thoughts...

If the purpose of such a warning is to give the user a sense of security, it seems rather pointless, when you consider that nobody notices the error that doesn't appear.

In other words, if a site is NOT secure, the user may not realize it's not secure because no warning pops up. This warning tells you what you need to know, but not WHEN you need to know it.

link|improve this answer
Actually, when these messages are enabled, they appear both when you go from a non-secure to secure connection, and when you go from a secure to a non-secure connection. – Bavi_H Nov 6 '11 at 16:50
Not unlike a (missing) "lock" icon. – Daniel Beck Nov 6 '11 at 18:32
feedback
up vote 0 down vote

Usually such warning happens when you open websites with a selfsigned SSL certificate. For example, if you open https://google.com you should not receive such notification, but if SSL was created by website admin manually you will receive a notification. It's not critical but just a warning that SSL was not signed by a trusted SSL issuer like Comodo/Verisign/...

link|improve this answer
I'd say it can be pretty critical. It actually means that someone gives you a certification that is signed by nobody else but them. That a letter has a stamp, but the stamp does not belong to any official authority. Or a Dr. Foo is showing you his license that reads "Doctor Foo certified surgeon". Unless you really know that you should trust this certificate (perhaps because someone you already trust said to you that you can trust it), do not put your password there. There's no real safety. It could pretty well be any scam. – Alois Mahdal Jan 22 at 5:46
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.