Let's rethink the new icons

[Gitoffthelawn]

I love that the icons flip in v1.0. Great job!

I'm not sure about the color choice. My immediate thought was "they are backwards". But I understand what you're going for.

Right now, on an HTTPS site, the icon is red, indicating that if you press it, something "bad" will happen: the loss of HTTPS. Makes sense. But that means every time the user is on a "good" site (HTTPS), they will see red, indicating that there is a problem. It seems backwards to me.

One option is to simply flip the icons from how they are now. I think that is my preference.

Another option would be to use the green icon on HTTPS sites, and a gray icon on HTTP sites.

Finally, changing the lock symbol to be unlocked when on an HTTP site would be useful. That way it indicates the state of the current site.

Thanks again for all your hard work. You've done an incredible job!

[sanspace]

When reading the 2nd para, I had already thought of 🔒 and 🔓 and there you are in the final para talking about the same thing.

It's just a matter of finding a good iconset. Will look for one. I also like the option of grayscaling the icon on http site. Thank you for your support all along! 👼

[sanspace]

I also thought the padlocks might confuse the users as they look similar to the one that browsers display for site information along with the certificate info on the far left side of the URL bar.

I am no designer. So, I will look for iconsets / svg that fits our need.

[Atavic]

application-certificate.png is here.

[Gitoffthelawn]

With current versions of Firefox, are there any cases where a connection is made via HTTPS and it is not considered secure by Firefox? IOW, any cases where the HTTPS is used and Firefox's new green padlock icon is not present?

In the past, Firefox allowed HTTPS connections that used weak ciphers, but I think it no longer allows those by default.

I'll ping @CHEF-KOCH and @Thorin-Oakenpants and @pyllyukko because one of them might know.

[sanspace]

@Atavic Thank you. But, we are looking for two icons to toggle colors (green and gray) as suggested by @Gitoffthelawn

@Gitoffthelawn I think it's a whole different area to explore. We should be fine if we could find something that doesn't look similar to Firefox's padlock.

[Atavic]

@Gitoffthelawn There are a few still around - mainly unmantained sites.

[Gitoffthelawn]

@Atavic Thanks. If you have an example, I'm curious. No problem if you don't.

@sanspace "...something that doesn't look similar to Firefox's padlock..." I agree. This is going to be a fun challenge!

[sanspace]

@Gitoffthelawn Yes, of course. Any icon that's tagged with 'secure' ends up being a padlock!

https://commons.wikimedia.org/wiki/File:Crystal_Project_Lock.png
https://commons.wikimedia.org/wiki/File:Crystal_Project_Unlock.png

[Atavic]

I haven't right now. BTW it's possible to see SHA-1 certificates that will expire in 2019.

Is the issue about a possible 3rd icon for these unsecure sites?

[sanspace]

We just don't want show a padlock on a non-http site and end up with some naive user mistake it for the site being secure. Current version is at the risk of doing it! My bad! 😢

[Atavic]

ssllabs has the T category on the bottom right.

2 of the Recent Worst with T Rating still have SHA-1

These sites are less than 1% of the https urls.

[pyllyukko]

(Not sure if this is still relevant.)

With current versions of Firefox, are there any cases where a connection is made via HTTPS and it is not considered secure by Firefox? IOW, any cases where the HTTPS is used and Firefox's new green padlock icon is not present?

Yes. At least with security.ssl.treat_unsafe_negotiation_as_broken:

[Thorin-Oakenpants]

IOW, any cases where the HTTPS is used and Firefox's new green padlock icon is not present?

Kinda - re: the "extra green" padlock as Steve Gibson describes it & EV. See https://www.grc.com/fingerprints.htm . A SSL Proxy (or MiTM) ... or Antivirus "Web" components

Instead of connecting to the remote web server, the browser is “securely” connected only to the local Proxy Appliance which is decrypting, inspecting, and logging all of the material sent from the browser

Once the SSL Proxy Appliance has decrypted, inspected and judged the user's content, it establishes a second secure connection to the remote web server—this time impersonating the user. Assuming that the user's request and data meet with the network's policies, or perhaps after having all been logged, the data is re-encrypted through the second connection to the remote web site . . . just as if nothing had happened.

Can this SSL Interception be PREVENTED?
No. But it CAN be reliably detected because it is NOT POSSIBLE to COMPLETELY spoof ANY security certificate!

This means that no matter how much any SSL Proxy Appliance might want to duplicate a remote server's certificate . . . it cannot. It is impossible. And the certificate's fingerprint, which can be easily viewed through any web browser's user-interface, completely gives away the lie

In Firefox and Chrome, only 100% authentic Extended Validation (EV) certificates will display the extra "Green" indication!

I'm not sure when he wrote that (2016 I think). And I haven't viewed that page thru a SSL Proxy to see the different padlock color in Firefox - so I have no idea what a green padlock vs an extra green one looks like.