1226847 - Remove key bits from Security tab of Page Info

Status: NEW

(Firefox :: Page Info Window, defect)

Description

[Masatoshi Kimura [:emk]]

Attachment: patch

- This is redundant. Cipher suite names will contain the key bits.
- This is misleading. People tend to think 256-bit is always better than 128-bit.

Comment 1

[Justin Dolske [:Dolske]]

Comment on attachment 8690389 [details] [diff] [review]
patch

Seems ok at a glance, but Tim can think more about it.

Comment 2

[Tim Taubert [:ttaubert] (inactive)]

Comment on attachment 8690389 [details] [diff] [review]
patch

I'm not convinced that the page info dialog is something we'd want or should tweak at this point. Also, how big is the group of people that might think 256-bit keys are always better than 128-bit ones, but doesn't know about algorithms? And how big is the group of people that uses the page info dialog that doesn't know?

Anyway, I think Tanvi is a better person to judge whether we'd want to change this.

Comment 3

[Tanvi Vyas[:tanvi]]

(In reply to Tim Taubert [:ttaubert] from comment #2)
> Comment on attachment 8690389 [details] [diff] [review]
> patch
> 
> I'm not convinced that the page info dialog is something we'd want or should
> tweak at this point. Also, how big is the group of people that might think
> 256-bit keys are always better than 128-bit ones, but doesn't know about
> algorithms? And how big is the group of people that uses the page info
> dialog that doesn't know?
> 
> Anyway, I think Tanvi is a better person to judge whether we'd want to
> change this.

Isn't more information better than less information?  Sometimes both 128 and 256 are listed in the cipher name.

I don't know what are plans are the Security pane in Page Info.  But the people who read the "Technical Details" section are likely very technical.  I don't really care either way if we keep or remove the bits.  Maybe some technical users ignore the cipher and just look at the bits, and maybe some look at both?

cc'ing more people to see if they have an opinion.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

The information "128 bit keys" is not so useful (and indeed, potentially misleading) without knowing the specifics of the ciphersuite (and the certificate chain, to be complete). I'd say it would be an improvement to remove it.

An even better improvement would be the ability to actually select and copy the ciphersuite in the info dialog there.