A Usability Evaluation of Let's Encrypt and Certbot: Usable Security Done Right

Tiefenau, Christian and von Zezschwitz, Emanuel and Häring, Maximilian and Krombholz, Katharina and Smith, Matthew
(2019) A Usability Evaluation of Let's Encrypt and Certbot: Usable Security Done Right.
In: CCS 19, London, UK.
Conference: CCS - ACM Conference on Computer and Communications Security

[img] Text
2019___CCS___Paper___LetsEncrypt___v4 (2).pdf

Download (1MB)

Abstract

The correct configuration of HTTPS is a complex set of tasks, which many administrators have struggled with in the past. Let's Encrypt and Electronic Frontier Foundation's Certbot aim to improve the TLS ecosystem by offering free trusted certificates (Let's Encrypt) and by providing user-friendly support to configure and harden TLS (Certbot). Although adoption rates have increased, to date, there has been only a little scientific evidence of the actual usability and security benefits of this semi-automated approach. Therefore, we conducted a randomized control trial to evaluate the usability of Let's Encrypt and Certbot in comparison to the traditional certificate authority approach. We performed a within-subjects lab study with 31 participants. The study sheds light on the security and usability enhancements that Let's Encrypt and Certbot provide. We highlight how usability improvements aimed at administrators can have a large impact on security and discuss takeaways for Certbot and other security-related tasks that experts struggle with.

Actions

Actions (login required)

View Item View Item