As I’ve noted many times, Google has world-class security and privacy teams. Great people.
But at least judging from the Google-related queries I get in my inbox every day, Google’s expanding efforts to warn users about perceived security issues are sowing increasing confusion and in some cases serious concerns, especially among nontechnical users who depend upon Google’s products and services in their daily lives.
A new example popped up today that I’ll get to in a moment, but I’ve been discussing these issues for quite a while, e.g.:
“When Google’s Chrome Security Warnings Can Do More Harm Than Good” –https://lauren.vortex.com/archive/001157.html
and:
“Here’s Where Google Hid the SSL Certificate Information That You May Need” –
https://lauren.vortex.com/2017/01/28/heres-where-google-hid-the-ssl-certificate-information-you-may-need
In a nutshell, Google’s continuing efforts at increasing user security — while utterly justifiable at the technical level — continue to marginalize many users who don’t really understand what Google is doing, are confused by Google’s security and other warnings, can’t effectively influence websites with “poor” security to make security improvements, and have no alternatives to accessing those sites in any case.
These are real people — I believe many millions of them — and I do not believe that Google really understands how important they are and how Google is leaving them behind.
Today brought yet another illustrative example that yes, even confused me for a time.
It involves cat food.
A friend forwarded me an email from PetSmart that included a link for an individualized 30% off coupon that they intended to use to buy cat food. That’s a damned good coupon, especially for those of us who aren’t rolling in dough. I wish I had a coupon like that today for Leela the Siamese Snowshoe.
The concern with this email was that every time the user clicked on the link in Gmail to access the site where the coupon could be printed, Gmail popped a modal security warning:
“Suspicious link – This link leads to an untrusted site. Are you sure you want to proceed to click email-petsmart.com?”
You can see a screenshot at the bottom of this post.
The obvious questions: What the hell does “suspicious link” mean in this context? What does Google mean by “untrusted site” in this scope?
There are no links to explanations, and if you Google around you can find lots of people asking similar questions about this class of Gmail warning, but no definitive answers, just lots of (mostly uninformed) speculation.
So I spent about 15 minutes digging this one down. Is email-petsmart.com a phishing domain targeting PetSmart users? Apparently not. It’s registered to ExactTarget, Inc. and has been registered since 2012. So while there’s no obvious authoritative mention of PetSmart there, my experience leads me to believe that they’re most likely a legit marketing partner of PetSmart, providing those emails and coupon services.
Of course, I still have no information about why Google is tagging them as suspicious. Is it the lack of https: security on the URL? Is it some aspect of their email-petsmart naming schema?
Damned if I know. Google isn’t telling me. And how would the average non-techie be expected to unravel any of this?
I told the user to go ahead and click the link. They got their coupon. Their kitties should be happy.
I’m not happy.
In the real world, most users don’t understand this stuff at the level they need to make truly informed decisions. So they’re forced — simply to get on with their lives every day — to click through such warnings blindly, to get to where they need to go.
And make no mistake about it, these kinds of scenarios are teaching these users absolutely abysmal security habits.
Google is terrific at tech. But Google is still struggling when it comes to understanding the broad range of their users and those users’ needs — particularly the non-techies — and especially how to communicate with those users effectively.
Google can do much better.
–Lauren–
