Re: Chrome will start marking HTTP pages as "Not secure"

[Martin Thomson]

+ffxdev

There's a tangible difference between text saying "Not Secure" and a
broken lock icon. I think that we're close, but we'd be making a
stronger statement than Chrome if we did this.

On Fri, Feb 9, 2018 at 8:17 AM, Chris Peterson <cpet...@mozilla.com> wrote:
> Chrome will start marking HTTP pages as "Not secure" in July 2018 (Chrome
> 68):
>
> https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html
>
> Firefox has a similar insecure HTTP warning icon, currently disabled by the
> `security.insecure_connection_icon.enabled` pref added in bug 1310447.
>
> Are there any blockers for Firefox shipping this feature?
> _______________________________________________
> dev-platform mailing list
> dev-pl...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-platform

[Tom Schuster]

If you flip just security.insecure_connection_text.enabled and not
security.insecure_connection_icon.enabled you get Chrome's behavior.
Flipping both gives you the broken lock and the "Not Secure" text. I
don't see a big difference there and I hope we can ship this as soon
as possible.

> _______________________________________________
> firefox-dev mailing list
> firef...@mozilla.org
> https://mail.mozilla.org/listinfo/firefox-dev
>

[Jonathan Kingston]

Hey,

So we have two issues here:
- We have less testing on security.insecure_connection_text.enabled
- security.insecure_connection_icon.enabled is a lot heavier handed as MT
notes and also we use this for insecure passwords too.

We also have the pbmode variants if we wanted both enabled when in Private
Browsing mode.

We are discussing the impact of shipping the "Not Secure" text with product
at the moment which is likely much safer to ship right now.

Thanks
Jonathan

[Johann Hofmann]

Yeah, there's a team working on this stuff (and they/we have been in
touch with the Chrome people for a long time) and this is not a call we
should make on a mailing list. There's a valid concern around warning
fatigue (plastering so many sites with "Insecure" that users easily
dismiss it) and we made those prefs to be able to run user studies on it.

I believe the original question was whether there are any blockers to
shipping this in Firefox right now. Technically? No. We should still
give product the chance to take a good look at the potential impact and
how it works in our design concept and not make this a race to the moon.

Thanks

Johann

[Karl Dubost]

Johann,

Le 10 févr. 2018 à 00:51, Johann Hofmann <jhof...@mozilla.com> a écrit :
> There's a valid concern around warning fatigue (plastering so many sites with "Insecure" that users easily dismiss it) and we made those prefs to be able to run user studies on it.

Did Mozilla run UX studies about it? If yes, links would be appreciated.

Secure/Insecure intuitively seems for me a wrong metaphor. Or more exactly a metaphor which has been carried away too long and has now lost its meaning. Some HTTPS sites are/will not be secure. And some HTTP sites will be more innocuous than some HTTPS sites.



--
Karl Dubost, mozilla 💡 Webcompat
http://www.la-grange.net/karl/moz

[Bram Pitoyo]

I’ve forwarded this conversation thread to our UX researcher and designer,
Francis and Jacqueline. If we’ve run any studies, they’d be able to link us
to a report.

[Francis Djabri]

We haven't run any studies on security indicators as yet.

--

*Francis Djabri*
Firefox User Research
e: fdj...@mozilla.com
+1 (415) 696-2786 <(415)%20696-2786>