Website Identity Notification: Testing the Simplest Thing That Could Possibly Work Users are used to authenticating themselves to websites, but not for websites to authenticate to them. One readily available mechanism that may help users make safer online decisions lies in website certificates that contain website identity information. Fraudulent websites are now shortlived and present valid certificates without any identity information. Our goal was to create and test the effectiveness of simpler certificate interfaces, made to help users differentiate between identityverified websites and those without such verification, and thus, potentially fraudulent. We conducted a study with a certificate interface prototype with simple identity notification types. Our findings suggest that presenting identity information to users can help them differentiate between real and potentially fraudulent websites. Some users were suspicious of the notifications and incorrectly felt that they could make decisions based on website appearance, so building user background knowledge is essential.

An artifact for X.509 digital certificates delivery In this work we address a problem of practical relevance the delivery of X.509 v3 digital certificates to end users on personal computers and smartphones and we seek to describe the design, construction and evaluation of an artifact with which it is possible to solve it. Seven metarequirements were defined, which have been instantiated into an artifact, which in turn has been empirically evaluated. The evaluation of the artifact has demonstrated its effectiveness based on actual use and perceived ease of use. The results of this work contribute to positioning personal computers and smartphones as alternative cryptographic modules to smart cards for some usage scenarios.