Re:Ask HN: Is Google phasing out Authenticator/TOTP?
by necovek on Thursday February 24, 2022 @09:32AM
(#30455135)
It's again a user expectation problem. What if you connect to a web site for the first time while on a rogue public network?
If users expect to be "safe" when on a secure site, without them understanding intricacies of certificates, self-signed is counter productive.
There are certainly improvements to be made to the experience, but none of that can explain all these nuances in a way a temporary visitor will read and grasp.
OTOH, it's easier to teach them "HTTP unsafe, don't type anything private".
If users expect to be "safe" when on a secure site, without them understanding intricacies of certificates, self-signed is counter productive.
There are certainly improvements to be made to the experience, but none of that can explain all these nuances in a way a temporary visitor will read and grasp.
OTOH, it's easier to teach them "HTTP unsafe, don't type anything private".