(2019) A Usability Evaluation of Let's Encrypt and Certbot: Usable Security Done Right.
|
Text
2019___CCS___Paper___LetsEncrypt___v4 (2).pdf Download (1MB) | Preview |
Abstract
The correct configuration of HTTPS is a complex set of tasks, which many administrators have struggled with in the past. Let's Encrypt and Electronic Frontier Foundation's Certbot aim to improve the TLS ecosystem by offering free trusted certificates (Let's Encrypt) and by providing user-friendly support to configure and harden TLS (Certbot). Although adoption rates have increased, to date, there has been only a little scientific evidence of the actual usability and security benefits of this semi-automated approach. Therefore, we conducted a randomized control trial to evaluate the usability of Let's Encrypt and Certbot in comparison to the traditional certificate authority approach. We performed a within-subjects lab study with 31 participants. The study sheds light on the security and usability enhancements that Let's Encrypt and Certbot provide. We highlight how usability improvements aimed at administrators can have a large impact on security and discuss takeaways for Certbot and other security-related tasks that experts struggle with.
| Item Type: | Conference or Workshop Item (A Paper) (Paper) |
|---|---|
| Divisions: | Katharina Krombholz (Human-Oriented Security, HOS) |
| Conference: | CCS ACM Conference on Computer and Communications Security |
| Depositing User: | Katharina Krombholz |
| Date Deposited: | 14 Oct 2019 12:23 |
| Last Modified: | 14 Oct 2019 12:23 |
| Primary Research Area: | NRA5: Empirical & Behavioral Security |
| URI: | https://publications.cispa.saarland/id/eprint/2977 |
Actions
Actions (login required)
 |
View Item |