News for hackers. Stuff that matters.
Re:Ask HN: Is Google phasing out Authenticator/TOTP? by necovek on Thursday February 24, 2022 @09:32AM (#30455135)
It's again a user expectation problem. What if you connect to a web site for the first time while on a rogue public network?

If users expect to be "safe" when on a secure site, without them understanding intricacies of certificates, self-signed is counter productive.

There are certainly improvements to be made to the experience, but none of that can explain all these nuances in a way a temporary visitor will read and grasp.

OTOH, it's easier to teach them "HTTP unsafe, don't type anything private".

There are no comments on this comment yet.