<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Helvetica, Arial, sans-serif">In Firefox 42, the design
of our security UI, mixed content blocker, and control center have
changed significantly. Aislinn and I have actually written a blog
post describing the details that is set to release on November
3rd. We too have tried to reduce the number of security icons to
avoid confusing the user. We have slightly hidden the Mixed
Content unblocking option since from telemetry we see that it is
hardly used. In the future, we plan to remove the globe from http
pages since the neutral icon doesn't add any value in that case.<br>
<br>
The "HTTPS with minor errors" case is used for mixed display
content, weak crypto in certificates, and (in the future) pages
that went through a cert override. Before Firefox 42, we used a
grey warning triangle with an exclamation mark for this case. The
new icon is very similar to Chromes - a gray lock with a yellow
warning triangle. When the user clicks the Control Center, they
can drill down and learn what the yellow warning triangle means.<br>
<br>
Let's see how things go with Firefox 42 and see if we get feedback
on this new UI. Then we can try and determine whether the minor
errors icon is really preventing sites from moving to HTTPS. I
will also reach out to Chrome to see if they have any data they
can share with us.<br>
<br>
Thanks!<br>
<br>
~Tanvi<br>
</font><br>
<div class="moz-cite-prefix">On 10/14/15 3:51 AM, Gervase Markham
wrote:<br>
</div>
<blockquote cite="mid:561E33B7.4070301@mozilla.org" type="cite">
<pre wrap="">On 13/10/15 23:53, Chris Peterson wrote:
</pre>
<blockquote type="cite">
<pre wrap="">This UX change would make it easier for sites to incrementally adopt
HTTPS without their site looking "broken". Is the security value from
mixed content warnings greater than making incremental HTTPS adoption
easier?
</pre>
</blockquote>
<pre wrap="">
I'm not sure the mixed content warning has significant value - I doubt
many users understand it. Fewer security states is good. However, the
one trouble with this proposal is that you then have "http_s_" but no
lock. Some places online say to look for "https" (because some browsers
don't have a lock), some say to look for a lock.
If we also hid the scheme, to make it look exactly like pure HTTP, then
I think that would have less possibility for confusion. Although I
suspect they considered and rejected that idea, so I'd be curious to
know why.
Gerv
_______________________________________________
firefox-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:firefox-dev@mozilla.org">firefox-dev@mozilla.org</a>
<a class="moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/firefox-dev">https://mail.mozilla.org/listinfo/firefox-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>