Show a survey within a day of setup, perhaps on what the HTTPS lock means

[moduloprime]

See "feedback from my friends-and-family users" thread

[adrifelt]

@egmorant are you gonna write this question? or palmer? (or someone else?) I'd like to have the question by Monday (and sooner would even be better) so I can add it before the friends-and-family dogfood ends.

[adrifelt]

From Palmer:

""" Origin-related questions for CUES:

• Is www.google.com the same site as google.com?
• Is google.com the same site as google.co.uk?
• Is nytimes.com the same site as newyorktimes.biz?
• Is www.google.com run by the same organization as google.com?
• Is google.com run by the same organization as google.co.uk?
• Is nytimes.com run by the same organization as newyorktimes.biz? """

As for HTTPS specifically, I'm not sure what to ask. egm's questions seem reasonable. I might try to ask some semi-directed questions (using ExampleCorp to try to remove reliance on brand identity):

• [on https://mail.example.com] When your browser communicates your email to and from ExampleCorp's systems, are the communications protected from eavesdropping?
• [on http://docs.example.com] When you are writing a document with ExampleCorp's document web app, is your document private?

[adrifelt]

From @egmorant:

Do you look at this? Have you seen this before? Have you clicked on this? Why? What does the green lock icon mean?