441211 - the 'no site info' tooltip from location bar can be less intrusive, more informative

Status: RESOLVED WONTFIX

(Firefox :: Security, defect)

Description

[Ray Kiddy]

The site-specific preferences and the "site identity" info from the location in FF3 are both great features, but they can be done in a more user-friendly and user-manageable manner. I think that these suggestions are all possible and are not exclusive of each other. It would be good to do any or all of these.

- Right now, for an unverifiable site, the tooltip says 'This web site does not display identity information'. It could say 'Unverified...'.

- In the security preferences, two checkboxes are:
[ ] Tell me if the site I'm visiting is a suspected attack site
[ ] Tell me if the site I'm visiting is a suspected forgery
Add:
[ ] Tell me if the site I'm visiting is not verifiable identifiable
I would suggest this should be un-checked by default, but I can see the other side of that as valid also.

- Right now, a command-click on the location bar icon (on Mac OS X) gives a "info box" that says:
  This web site does not supply identity information.
  Your connection to this site is not encrypted.
It could also say:
  Disable this warning in the Security tab of the Preferences.

- When one gets the "info box" above, there is a "More information" button which takes you to a site-specific options pane. That pane can have an option for 'Do not warn about lack of identity verification for this site.'

Comment 1

[Johnathan Nightingale [:johnath]]

I'm not sure I understand what's being proposed here, though I appreciate the attempt to continue making things more friendly.  What would be the effect of enabling/disabling this pref, in terms of the UI?  Would clicking the site button do nothing, when this was unchecked?

This UI isn't there as a warning, it's there so that regardless of page state, there's always a way to find out what Firefox knows about a site.  The padlock failed to do this because it disappeared on non-http sites, there was no primary-chrome way to invoke information about a site's identity in those cases. It's not clear to me whether you are recommending a return to that kind of behaviour here or not?
 

Comment 2

[Ray Kiddy]

If one un-checked the "Tell me if the site I'm visiting is not verifiable identifiable" preference, one would see the same white icon in the location bar but there would be no tooltip.

If one went to the site-specific pane and checked the proposed "Do not warn about lack of identity verification for this site" option, this would be true for this site only.

Comment 3

[Johnathan Nightingale [:johnath]]

So this pref would disable the tooltip?  Isn't the tooltip only on hover anyhow?  I'm not trying to be combative, I hope it doesn't sound that way, but I don't think we would land a pref that only served to sometimes hide a tooltip.

I do agree that the tooltip currently gets in the way of drag operations, but I think that's better solved by bug 312852.

Comment 4

[Mike Connor [:mconnor]]

This isn't a warning, maybe the text should be tweaked, but it hasn't been an issue before.

Adding a pref to hide a tooltip doesn't make sense.  Per-site prefs is even more nonsensical.

WONTFIX.

Comment 5

[Ray Kiddy]

No combativeness assumed. We all just care. :-)

And it has not been an issue to who? FF3 was just shipped. It was not an issue for the self-selected group of early adopters?

I think the tooltip, because of its size and placement on the page, is very distracting. It is more distracting than is justified. In a better world, there would be very few unverified web sites, but we are not there yet. MoCo wants to encourage people to get there, I know. But a preference will allow those of us who might be more distractable to stop this tooltip from appearing.

Also, I am not sure what time one has to be stationary for a 'hover' event to occur. It seems to me that I can be moving around a page, moving the mouse to the menu bar, for example, and the tooltip comes up. Did I pause for 1/4 second? Maybe. While fixes are made to the drag or whatever else, let me disable it.

Also, the tooltip is arguably "helpful information" from the browser. It is helpful, but it is not critical to letting me do what I want to do, so I really, really want to disable it.

Comment 6

[Ray Kiddy]

Attachment: changes string in overly long "helpful" tooltip to "Unverified."

Comment 7

[Ray Kiddy]

Comment on attachment 328333 [details] [diff] [review]
changes string in overly long "helpful" tooltip to "Unverified."


Would this change be unacceptable? More brief is better, yes?

Comment 8

[Mike Connor [:mconnor]]

Comment on attachment 328333 [details] [diff] [review]
changes string in overly long "helpful" tooltip to "Unverified."

No.  This is basically meaningless, IMO.

Comment 9

[Ray Kiddy]

I am not seeing the problem with changing the tooltip. The text now is too long. I do not know why you do not think this tooltip is bothersome, but bug 312852 shows a high level of annoyance from this in the community. This is a very, very small change that will reduce the bother caused by this tooltip.

I am sorry, but I always hear talk of the Mozilla community and how important it is to everyone. Your WONTFIX seems very arbitrary. Have you given any reasons somewhere else that I might not have seen. Do you believe that arbitrary WONTFIX declarations help make the Mozilla community feel more inclusive?

Comment 10

[Johnathan Nightingale [:johnath]]

(In reply to comment #9)
> I am not seeing the problem with changing the tooltip. The text now is too
> long. I do not know why you do not think this tooltip is bothersome, but bug
> 312852 shows a high level of annoyance from this in the community. This is a
> very, very small change that will reduce the bother caused by this tooltip.

Without meaning to put words in your mouth, I think you'd agree that the right way to solve the problems in bug 312852 is to solve bug 312852.  This patch causes a long tooltip which explains the information it is trying to supply (e.g. verified identity information) with an abbreviated one that lacks that discoverability ("What's unverified?"), and still leaves us with a tooltip getting in the way on drag events. 

> I am sorry, but I always hear talk of the Mozilla community and how important
> it is to everyone. Your WONTFIX seems very arbitrary. Have you given any
> reasons somewhere else that I might not have seen. Do you believe that
> arbitrary WONTFIX declarations help make the Mozilla community feel more
> inclusive?

You and I both know that bugzilla isn't the place for advocacy, but I will say that I see nothing incompatible about respecting (indeed, relying upon) the Mozilla community on one hand, and a module owner WONTFIXing individual bugs on the other.  The community is dedicated to the vision and principles of the project, but we have a decision making structure too, and it is not consensus-based.