

Switch generic icon to negative feedback for non-https sites - diafygi
https://bugzilla.mozilla.org/show_bug.cgi?id=1041087

======
codezero
There have been a few times when I've got a legitimate red icon for bad
certificates and what not. Pushing this to the rest of the web will mean I'll
miss real errors through the noise because they happen so infrequently that
I'll just stop checking if every website has a red icon.

~~~
briansmith
Browsers completely stop the page from loading and show a full-page error for
a certificate error. There's a huge difference between that and a small icon
in the location bar. Plus, if the red icon that is suggested in that bug
report is too loud, a less loud indicator could be used instead.

There's a lot more to designing a UI for this than just changing the icon. For
example, when you type "foo.com" into the address bar, browsers generally
default to "[http://foo.com"](http://foo.com") instead of
"[https://foo.com."](https://foo.com.") And, consequently, browsers tend to
show "[http://foo.com"](http://foo.com") as "foo.com" to suggest that you
don't need to type the "[http://"](http://") part. All of that needs to change
to become a lot smarter in order for this type of idea to succeed. However, it
doesn't seem completely unreasonable to consider making all those changes. In
fact, I think these changes should be a high priority for browsers makers.

tl;dr: I suggest people brainstorm ways to improve upon the idea to make it
workable, instead of trying to shoot it down.

~~~
codezero
Honestly, I'd prefer a heuristic that could determine whether https was
significant on the current URL. Are there submitted values, cookies of
importance, get parameters? There are a lot of reasons https is important and
there are a lot of places where it's totally not important.

If you draw people's attention to something that isn't seriously important,
then those times when the whole screen sends a warning you go, "oh well, I had
that red warning going all along and it didn't matter, so why do I care?"

I am saying that by pushing a warning where it's not necessary, you diminish
the value of any warning.

~~~
briansmith
> There are a lot of places where it's totally not important.

See my other replies on this page for some reasons why I think there are no
pages where HTTPS is not important.

I agree with you regarding the UI issues and the potential to generate apathy
by crying wolf. That's why I think that the specifics of the linked-to
proposal won't work. But, I think the general idea is worth investigating. It
just requires some user research.

Also, the fact that browsers support a non-HTTPS mode at all is really the
bigger UI issue. Imagine if HTTPS was the only option. The biggest UI security
problems would instantly vanish! That's a big reason why a lot of people are
actively working so hard on finding ways to make HTTPS work for everybody on
every site.

------
mplewis
Putting a red icon on 90% of all websites means the meaning of the icon will
just saturate and people won't pay attention to the red icon any more.

~~~
briansmith
FWIW, ~33% of all pages are loaded over HTTPS already in Firefox, according to
the metrics collected by the browser. And, over 50% of all HTTP requests
(including subresources like images and scripts embedded on a page) are over
HTTPS, again according to the usage data collected by the browser.

~~~
scrollaway
I'd be willing to bet quite high all these HTTPS requests are all on the same
specific services (facebook, gmail, google would already take most of them).

------
danso
No.

Not all sites exchange data worth the SSL-layer...let's say, 30-50% of the
sites...that means for roughly half a user's non-email/social-networking web-
browsing, they're going to either be saturated with a warning message that, if
psychology research is to believed, is going to be promptly ignored like your
apartment's super-sensitive smoke detector or the boy watching out for wolves.

What's the actual reasoning in OP's mind here? That the average web user is
someone who, when the computer gives some warning sign that is disconnected
from any kind of discernable threat, that the user will automatically take it
seriously? That they'll demand to know why they're in danger, and then will
rise up and petition the Internet regulatory commission to make all sites do
what it takes to make that red icon go away, and the web will be more secure?

I don't want to be overtly negative towards well-intended idealism, but this
is such a bizarrely naive viewpoint that it must be openly challenged. That,
and it just blithely ignores all the research showing what happens when humans
are overloaded with impotent warning signs. This is the kind of idealism-
without-consequences that can end up causing more harm than good.

~~~
scrollaway
This is not a user-oriented proposal, this is clearly directed at the website
owners which are not going to want _their_ users to see red stuff on the URL
bar.

~~~
danso
Not a bad strategy. Until the website owners take the path of least resistance
between:

A. Reconfiguring their stack to use SSL.

B. Putting a Javascript-powered banner helpfully informing all Firefox users
that their browser has a security flaw ("that's why that red icon is there")
and they should follow the included hyperlinks to install the latest versions
of Internet Explorer or Chrome and then delete Firefox from their systems.

~~~
scrollaway
That B strategy might have worked a few years back for grandmas that got
Firefox installed by their geeky grandson, but Firefox is popular now. And
people (geek or no geek) don't like being told the stuff _they_ use is not
good.

Here's an experiment you can do at home: Try telling an emacs user Vim is
better.

------
omni
Why should my blog of static pages need to be served over HTTPS to avoid
having Firefox slap a scary red icon next to it?

~~~
scrollaway
Why shouldn't it is the real question.

There's a parallel universe where ssh is plaintext, and only "sensitive
commands", such as "sudo", are encrypted. In that universe though, plaintext
HTTP doesn't exist and they're making fun of us.

~~~
mynameisvlad
Because no sensitive content is being transferred. Why put the extra hassle of
getting and installing a non-self-signed certificate for a blog where the user
doesn't even submit data? There's no reason for that connection to be secure.

~~~
scrollaway
> Because no sensitive content is being transferred.

You're answering "why" instead of answering "why not" again. "Why should you
lock your door if you don't have anything expensive?"

Plaintext HTTP should not exist, then we wouldn't be having this discussion. I
wouldn't have to come up with elaborate scenarios where having HTTPS from the
get go would have saved lives, and you wouldn't have to come up with crazy
"but that'll never happen" retort to them.

Unfortunately, plaintext HTTP exists, so here we are, with me telling you that
the pro-gay rights piece you wrote on your static blog contains keywords that
make it be viewed as extremism/terrorism by Russia's automated monitoring
systems and anyone reading it gets immediately added to a watchlist.
Unfortunately, a few of your readers are from russia and six months later
those readers join a political protest against the killing of kittens or
something. Their government notices that and makes sure to "take action". And
to think HTTPS could have avoided that.

~~~
Yver
> "Why should you lock your door if you don't have anything expensive?"

Locks come standard on every door, they don't expire after a given time and
every child knows how to use them. See how your comparison to acquiring,
setting up and maintainning an SSL certificate is nonsensical?

> And to think HTTPS could have avoided that.

If the NSA tags people who look for info on TOR as extremists, an hypothetical
state might tag people who use HTTPS. And to think that HTTP could have
avoided that! I mean, if every argument is an hypothetical, anything is
possible.

~~~
scrollaway
If HTTPS is used globally, people can't be flagged for using it (or the flags
end up being useless). Right now, you are correct, people could hypothetically
be flagged for using HTTPS. This would not happen if every static blog and
what not out there would use it.

Thank you for reinforcing my point, I appreciate the help.

------
rcthompson
What about warning the user when they start to type in a login box on a non-
https site? Browsers should already know what is a login box, since they know
how to prompt you to remember the password.

~~~
timmclean
Sort of like what IE used to do the first time you submitted a form?

[http://bmlinks-committee.jbmia.or.jp/eng/image/EnDlg03.gif](http://bmlinks-
committee.jbmia.or.jp/eng/image/EnDlg03.gif)

~~~
scrollaway
Talk about full circle.

------
john2x
The proposed icon is hard to parse. Better an open lock? And maybe in orange
instead of jarring red.

Or even better, make the secure icon something universally positive, like a
green smiley face or a check mark. Then the insecure icon can be an orange sad
face or X mark. (Lock icon can be ambiguous to non-techies. i.e. why is the
url locked? or is that a suitcase/purse?)

------
Karunamon
Greeaaaat. Just what everyone needs. An extra expense and further entrenchment
of our exploitative CA system.

I like this idea, but not when it puts more money in the pocket of the CAs.

~~~
scrollaway
If a better/broader alternative to CAs comes along and is adopted (say, such
as SPDY), I take it the icon would behave the same way. Your comment is really
unwarranted...

Not to mention this is just some random guy. It's not like mozilla is actually
thinking about this (they really should).

~~~
Karunamon
>Your comment is really unwarranted...

Not really - changes like this don't exist in a vacuum. Anything that makes
the existing CA's more indispensable (say, by driving customers their way by
making it appear bad to not do business with them) is a net negative.

------
kbaker
They should at least wait for DANE + DNSSEC, which is a tangible (and free)
alternative to the CA system, even though it would still be quite a bit of
effort.

I'd be curious to know how this would affect local servers in the intranet.
Surely we wouldn't want to have to start issuing certs for everything inside
the firewall as well?

I think this is a bit too shortsighted of a bug report. Anyways, since this is
not an official proposal, I think it will just be closed as invalid by
Mozilla.

------
peterkelly
I vote for the NSA logo

