On Mon, Jul 21, 2014 at 4:20 PM, Daniel Roesler <diaf...@gmail.com> wrote:
> Gotta start somewhere. Best case: no one will notice it after the first few days. Worst case: people notice it, and therefore start ignoring all https authentication errors. Is there a way to make the best case better, without ending up at the worst case? > I actually kind of like the idea of showing the > current generic icon for self-signed ssl certificates, and the broken > lock icon for insecure connections. That would mean that any active attacker on your network could silently MITM bank of america, with no visible change except for a subtle downgrade of the icon. > > > On Mon, Jul 21, 2014 at 4:10 PM, Adrienne Porter Felt <f...@chromium.org> > wrote: > > I would very much like to make http sites look insecure. > > > > But we face a very real problem: a large fraction of the web is still > > http-only. That means that: > > > > Users will get used to the insecure icon, and it will start looking > > meaningless pretty quickly. > > This might also make users ignore the broken https icon. > > > > I'm not sure how to reconcile this. > > > > > > On Mon, Jul 21, 2014 at 2:27 PM, 'Chris Palmer' via Security-dev > > <security-...@chromium.org> wrote: > >> > >> +security-...@chromium.org > >> > >> I also think it's a good idea to affirmatively label non-secure > >> origins as such, in some way. > >> > >> On Sat, Jul 19, 2014 at 12:10 PM, Eric Mill <e...@konklone.com> wrote: > >> > A good idea, though you need to be careful. Just posted to the bug: > >> > > >> > What you definitely *don't* want to do is give the user such negative > >> > feedback that they stop noticing when there's a direct problem > (insecure > >> > HTTPS). > >> > > >> > A grey unlocked padlock would be a nice way to ease people into the > idea > >> > that they are browsing a normal website that is insecure. > >> > > >> > > >> > > >> > On Sat, Jul 19, 2014 at 2:54 PM, Daniel Roesler <diaf...@gmail.com> > >> > wrote: > >> > > >> >> Howdy all, > >> >> > >> >> Yesterday, I created a bug proposing that Firefox switch the generic > >> >> url icon to a negative feedback icon for non-https sites. > >> >> > >> >> https://bugzilla.mozilla.org/show_bug.cgi?id=1041087 > >> >> > >> >> I created this bug because it's time we start treating insecure > >> >> connections as a Bug. There is so much open wifi available to the > >> >> modern internet user that a significant portion Firefox users' > >> >> requests can be sniffed. If that request is insecure, it makes > session > >> >> hijacking, MITM, and metadata attacks trivially easy. Not using https > >> >> should now be bad practice and considered harmful. > >> >> > >> >> Mozilla should be a leader and push websites to start securing their > >> >> connections. Many of the largest websites already default to https, > >> >> and it's time to start bringing the rest on board. Having negative > >> >> feedback for insecure connections offers a huge incentive to fixing > >> >> the larger Bug of insecure connections. > >> >> > >> >> Thanks and looking forward to any discussion, > >> >> Daniel Roesler > >> >> diaf...@gmail.com > >> >> _______________________________________________ > >> >> dev-security-policy mailing list > >> >> dev-security-policy@lists.mozilla.org > >> >> https://lists.mozilla.org/listinfo/dev-security-policy > >> >> > >> > > >> > > >> > > >> > -- > >> > konklone.com | @konklone <https://twitter.com/konklone> > >> > _______________________________________________ > >> > dev-security-policy mailing list > >> > dev-security-policy@lists.mozilla.org > >> > https://lists.mozilla.org/listinfo/dev-security-policy > > > > > _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
