4 ms·

I disagree with their rationale in changing the padlock used to indicate a DV certificate from grey to green (and thus mirroring EV certs) to a point: Yes, the

by phlo 11y ago

I disagree with their rationale in changing the padlock used to indicate a DV certificate from grey to green (and thus mirroring EV certs) to a point: Yes, the connection is secure, but given the numerous free and automated options to obtain DV certificates, phishing sites are going to increasingly use TLS, and mostly do so using DV certificates. I guess this boils down to me actually favouring a clear divide between EV and DV. My EV connection to bankofamerica.com should be as visually different from the DV connection to the phishing site bank0famer1ca.com as possible. As it is, the Firefox UI improves visibility of encryption while I think it might be more appropriate to improve the differentiation between encryption and authentication. As for all the other states: good work. The new iconography seems more streamlined and clear to me.

nailer 11y ago
Edge has done a really nice job here: DV is a hollow grey lock, EV is a solid green lock, plus the validated company name & jurisdiction. There's way less clutter in the address bar too, so the difference is more striking: http://imgur.com/7W4YmuZ http://imgur.com/7W4YmuZ
- betenoire 11y ago
  That's the point, that's what firefox is moving away from, isn't it?
  - nailer 11y ago
    Firefox is making DV certs look more secure, which is the opposite. If Firefox believe users don't know understand the difference, the logical thing is to help fix that, not make it worse.
_nedR 11y ago
For me the presence of the organisations name in green letters emphasizes the difference. (Besides the green/grey lock difference alone is small enough to miss) The UI choice i don't like is having a hazard sign for secure websites with mixed active content blocked . Hazard sign implies some hazard exists - but in this case the hazard has been averted, so why show a hazard sign still?
- phlo 11y ago
  > Hazard sign implies some hazard exists - but in this case the hazard has been averted, so why show a hazard sign still? The way I see it, the browser actively blocked a hazardous action. The site continues to be hazardous, and another browser might not properly block the action in question. As long as the site is trying to do hazardous things, it should be considered as such (and warned against).

by phlo 11y ago

nailer 11y ago

Edge has done a really nice job here: DV is a hollow grey lock, EV is a solid green lock, plus the validated company name & jurisdiction. There's way less clutter in the address bar too, so the difference is more striking: http://imgur.com/7W4YmuZ http://imgur.com/7W4YmuZ

betenoire 11y ago
That's the point, that's what firefox is moving away from, isn't it?
- nailer 11y ago
  Firefox is making DV certs look more secure, which is the opposite. If Firefox believe users don't know understand the difference, the logical thing is to help fix that, not make it worse.

_nedR 11y ago

For me the presence of the organisations name in green letters emphasizes the difference. (Besides the green/grey lock difference alone is small enough to miss) The UI choice i don't like is having a hazard sign for secure websites with mixed active content blocked . Hazard sign implies some hazard exists - but in this case the hazard has been averted, so why show a hazard sign still?

phlo 11y ago
> Hazard sign implies some hazard exists - but in this case the hazard has been averted, so why show a hazard sign still? The way I see it, the browser actively blocked a hazardous action. The site continues to be hazardous, and another browser might not properly block the action in question. As long as the site is trying to do hazardous things, it should be considered as such (and warned against).