1852949 - Set buttons delayed by `security.dialog_enable_delay` to `inert` instead of `disabled

Status: NEW

(Core :: DOM: Security, enhancement, P3)

Description

[Malte Jürgens [:maltejur]]

Some buttons on pages like the certificate error one currently have a delay of 1s (the time is specified in security.dialog_enable_delay) until they are enabled. This is to prevent pages tricking you into clicking the button by redirecting you to the error page just before you are about to click on the spot where the button will be.

But this can also feel like an annoyance to some users, so :dveditz suggested

I'd argue that using "inert" instead of "disabled" would be better: Users notice when it's greyed out and then changes; with inert it would look exactly the same and the only people who notice (because the click did nothing) would be those who were about to be tricked.

inert disables the button, but does not change the styling of it, so the user does not notice the button is disabled until they click on it and nothing happens.