1906011 - [Heuristic Evaluation] 1.5 Inconsistent feedback regarding site security between the lock symbol status (i.e. indicates a site is insecure) and the site being https (this appears to occur intermittently)

Status: NEW

(Firefox for Android :: Toolbar, defect, P3)

Description

[Chris Peterson [:cpeterson]]

Heuristic violation: 1.5 Inconsistent feedback regarding site security between the lock symbol status (i.e. indicates a site is insecure) and the site being https (this appears to occur intermittently)

Severity: Low

This bug was reported in the "Fx Mobile (Android) Core Browsing - Heuristic Evaluation Q2 2024":

https://docs.google.com/document/d/1vk05W3KlK5No88rpA3ZbEKXUMFou1ZZcnORSMERWeeU/edit

Related issues: bug 1881291 and bug 1897952

Comment 1

[Chris Peterson [:cpeterson]]

Aarjav recommends WONTFIX'ing this bug: if the user scrolls the page before we realize the page is insecure, then the address bar will hide before the user sees the secure lock icon change to an insecure icon. The user might mistakenly think an insecure page is secure.

OTOH, we know whether we're loading an http:// or https:// URL before the page loads. It's possible an https:// URL will redirect to an insecure page, but that's probably rare.

Chrome avoids this problem by not showing a lock icon on secure pages. Chrome shows a site permissions icon on secure pages and a warning icon on insecure pages.

Comment 2

[Manuel Bucher [:manuel]]

The user is not able to scroll at the time when we show an insecure lock icon until the HTTPS connection is established.

During that phase we effectively show about:blank (and the insecure lock icon might stem from bug 1897952). And about:blank is not scrollable, therefore the URL-Bar can't be hidden by the user.

On navigation we show the current lock symbol until we start showing the content of the next page. Therefore we don't mislead users there due to page content matches lock symbol + url.