If HTTPS Were Secure I Wouldn't Need 2FA - End User and Administrator Mental Models of HTTPS

Explore a comprehensive analysis of end user and administrator mental models of HTTPS in this 20-minute IEEE conference talk. Delve into the findings of a qualitative study involving 18 end users and 12 administrators, revealing misconceptions about security benefits and threat models. Examine the differences between end user and administrator mental models, with end users tending towards more conceptual understanding and administrators focusing on protocol-based knowledge. Discover how end users often confuse encryption with authentication, underestimate HTTPS security benefits, and disregard security indicators. Learn about administrators' challenges in understanding the interplay of functional protocol components. Gain insights into the implications of these mental models and receive actionable recommendations for improving user interfaces and protocols in the future.