749936 - Move security lock Icon

Status: NEW

(SeaMonkey :: UI Design, defect)

Description

[Daniel]

User Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:11.0) Gecko/20120312 SeaMonkey/2.8
Build ID: 20120312224753

Steps to reproduce:

Go to a secure address, e.g. bugzilla.mozilla.org


Actual results:

Browser address bar background colour changes to yellow (What's this mean?) and lock Icon in bottom right of screen shows as locked (if anyone notices) and its background colour changes to yellow (What's this mean??)


Expected results:

If the lock were up in the address bar (left end), it would be more noticeable, with or with-out the background colour change

Comment 1

[Matthias Versen [:Matti]]

It could be spoofed on the left side with a favicon

Comment 2

[therube]

FWIW, in FF...

Current: http://support.mozilla.org/en-US/kb/Site%20Identity%20Button
Future: http://msujaws.wordpress.com/2012/04/23/an-update-to-site-identity-in-desktop-firefox/ (Note beltzner's comment.)

Comment 3

[David E. Ross]

A padlock in the status bar (which was eliminated for Firefox but not SeaMonkey) complies with the recommendation of the US-CERT (an agency of the U.S. Department of Homeland Security).  A padlock on the same line as the URI bar also complies.  See <http://www.us-cert.gov/cas/tips/ST05-010.html>.  

Pale yellow -- the current default color in SeaMonkey for a secure Web site -- is not sufficiently noticeable.  I tweaked userChrome.css in my profiles to give pink for low-level security and bright green for high-level security.  However, color-coding is not suitable for all users and should not be the primary indicator of security; see bug #657442.

Comment 4

[Daniel]

David, as I said in my original post, in SeaMonkey, the padlock icon is down in the bottom right of screen.

If the padlock icon were up in the address bar or immediately to the left of it (*not* to the right of it), then, when I went to any website, I would be able to see the security status of that site whenever I looked at the address bar.

If a website tried to spoof its security status, by having a locked padlock as its Icon, I  would probably notice something was suspect by seeing an unlocked padlock right next to a locked padlock! It the two icons were seperated, i.e. security padlock being at right of address bar, or left in bottom right of screen, I and others may not notice!!

Comment 5

[Tony Mechelynck [:tonymec]]

Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20120430 Firefox/15.0a1 SeaMonkey/2.12a1 ID:20120430003051

The padlock has always been in the bottom right since Mozilla Suite times. Don't underestimate the conservatism of SeaMonkey users.
With the third-party theme I use it has the following variations (in the trunk nightly I'm running):
- open padlock with the same background as the rest of the status bar: no encryption
- closed padlock on pale yellow background (example: this page): encryption but no identity verification. This contrasts sharply with the background of the Persona I have enabled.
- closed padlock plus name of site owner, all on green background: encryption and identity verification (example: http://addons.mozilla.org/ ) In this case a policeman icon with green background ("Larry") also appears at the right end of the URL bar, as with Firefox
- (rare) padlock on pale yellow plus red diagonal over it: the current page mixes encrypted and unencrypted contents.

With the padlock on the left side of the URL bar it could be spoofed by means of a favicon. Maybe SeaMonkey users are more clever than Firefox ones but even if they are, that's an average. "Dumb" users would still be spoofed, and those are the ones most likely to do stupid things.

I propose to leave the padlock icon untouched. Adding Larry with other colours on the right end of the URL bar for other than full encryption with verification might be a possibility. Not on the left end.

I'm moving this bug to the "UI Design" component for the time being but it might belong in "Themes" instead, or even in "Security".

Comment 6

[Tony Mechelynck [:tonymec]]

oops, https://addons.mozilla.org/

Comment 7

[rsx11m]

(In reply to Tony Mechelynck [:tonymec] from comment #5)
> The padlock has always been in the bottom right since Mozilla Suite times.
> Don't underestimate the conservatism of SeaMonkey users.
> [...]
> I propose to leave the padlock icon untouched. Adding Larry with other
> colours on the right end of the URL bar for other than full encryption with
> verification might be a possibility. Not on the left end.

Agreed to both, keep changes moderate and not just for the sake of changing things from their usual place (this includes keeping the yellow color for fully-secured pages). There are already a bunch of icons in the right end of the location bar, thus adding some indicator for security strength on that side should be feasible.

Comment 8

[rsx11m]

I see the behavior Tony described in comment #5 also with the default and modern themes, which appears to be fully sufficient (unless I'm missing any cases). Thus, is anything beyond that envisioned for which any work would have to be done here, assuming that color variations for Larry may be taken care of in Toolkit?