Let's rethink the new icons

I love that the icons flip in v1.0. Great job!

I'm not sure about the color choice. My immediate thought was "they are backwards". But I understand what you're going for.

Right now, on an HTTPS site, the icon is red, indicating that if you press it, something "bad" will happen: the loss of HTTPS. Makes sense. But that means every time the user is on a "good" site (HTTPS), they will see red, indicating that there is a problem. It seems backwards to me.

One option is to simply flip the icons from how they are now. I think that is my preference.

Another option would be to use the green icon on HTTPS sites, and a gray icon on HTTP sites.

Finally, changing the lock symbol to be unlocked when on an HTTP site would be useful. That way it indicates the state of the current site.

Thanks again for all your hard work. You've done an incredible job!

When reading the 2nd para, I had already thought of 🔒 and 🔓 and there you are in the final para talking about the same thing.

It's just a matter of finding a good iconset. Will look for one. I also like the option of grayscaling the icon on http site. Thank you for your support all along! 👼

I also thought the padlocks might confuse the users as they look similar to the one that browsers display for site information along with the certificate info on the far left side of the URL bar.

I am no designer. So, I will look for iconsets / svg that fits our need.

application-certificate.png is here.

@CHEF-KOCH

With current versions of Firefox, are there any cases where a connection is made via HTTPS and it is not considered secure by Firefox? IOW, any cases where the HTTPS is used and Firefox's new green padlock icon is not present?

In the past, Firefox allowed HTTPS connections that used weak ciphers, but I think it no longer allows those by default.

I'll ping @CHEF-KOCH and @Thorin-Oakenpants and @pyllyukko because one of them might know.

@Atavic

@Atavic Thank you. But, we are looking for two icons to toggle colors (green and gray) as suggested by @Gitoffthelawn

@Gitoffthelawn I think it's a whole different area to explore. We should be fine if we could find something that doesn't look similar to Firefox's padlock.

@Gitoffthelawn

@Gitoffthelawn There are a few still around - mainly unmantained sites.

@Atavic

@Atavic Thanks. If you have an example, I'm curious. No problem if you don't.

@sanspace "...something that doesn't look similar to Firefox's padlock..." I agree. This is going to be a fun challenge!

@Gitoffthelawn

@Gitoffthelawn Yes, of course. Any icon that's tagged with 'secure' ends up being a padlock!

https://commons.wikimedia.org/wiki/File:Crystal_Project_Lock.png
https://commons.wikimedia.org/wiki/File:Crystal_Project_Unlock.png

I haven't right now. BTW it's possible to see SHA-1 certificates that will expire in 2019.

Is the issue about a possible 3rd icon for these unsecure sites?

We just don't want show a padlock on a non-http site and end up with some naive user mistake it for the site being secure. Current version is at the risk of doing it! My bad! 😢

ssllabs has the T category on the bottom right.

2 of the Recent Worst with T Rating still have SHA-1

These sites are less than 1% of the https urls.

(Not sure if this is still relevant.)

With current versions of Firefox, are there any cases where a connection is made via HTTPS and it is not considered secure by Firefox? IOW, any cases where the HTTPS is used and Firefox's new green padlock icon is not present?

Yes. At least with security.ssl.treat_unsafe_negotiation_as_broken:

IOW, any cases where the HTTPS is used and Firefox's new green padlock icon is not present?

Kinda - re: the "extra green" padlock as Steve Gibson describes it & EV. See https://www.grc.com/fingerprints.htm . A SSL Proxy (or MiTM) ... or Antivirus "Web" components

Instead of connecting to the remote web server, the browser is “securely” connected only to the local Proxy Appliance which is decrypting, inspecting, and logging all of the material sent from the browser

Once the SSL Proxy Appliance has decrypted, inspected and judged the user's content, it establishes a second secure connection to the remote web server—this time impersonating the user. Assuming that the user's request and data meet with the network's policies, or perhaps after having all been logged, the data is re-encrypted through the second connection to the remote web site . . . just as if nothing had happened.

Can this SSL Interception be PREVENTED?
No. But it CAN be reliably detected because it is NOT POSSIBLE to COMPLETELY spoof ANY security certificate!

This means that no matter how much any SSL Proxy Appliance might want to duplicate a remote server's certificate . . . it cannot. It is impossible. And the certificate's fingerprint, which can be easily viewed through any web browser's user-interface, completely gives away the lie

In Firefox and Chrome, only 100% authentic Extended Validation (EV) certificates will display the extra "Green" indication!

I'm not sure when he wrote that (2016 I think). And I haven't viewed that page thru a SSL Proxy to see the different padlock color in Firefox - so I have no idea what a green padlock vs an extra green one looks like.

Invitation accepted. :)

Branch created. New icons for consideration uploaded.

@Gitoffthelawn

I do not like them. Nothing personal, but a switch is something that should be under my fingers, not on my monitor. Lockers or shields have their own semiotic value, instead.

@Gitoffthelawn Moreover, I have problems with colors!

I appreciate the effort and I can't thank you both enough for your support for this project.

To be frank, I did not like the new icons too. Also, SVG would be a better format I guess.

switch green and red icons

Submitted for review at AMO. Let's keep looking until we find something. I'll keep this open until we really find a fix for this.

@sanspace

@sanspace You're welcome, and no problem. :)

@Atavic Nothing personal taken, but thank you for mentioning that! :) I appreciate your feedback.

Overall, the feedback is a touch disappointing, but that's ok... the community feedback is excellent and is what makes open-source software so great! :)

Here are the reasons I like the switches:

1. No confusion with Firefox's native SSL lock icon
2. Very simple
3. Works for colorblind people too, thus enhancing accessibility
4. Employs a common mental model of light switches: Up is on, down is off
5. Easy to scale, if needed
6. Didn't take hours to create ;)

So think about them a little more, if you will... but no problem either way.

The red dot / green dot idea I mentioned partially works too. Or just switching the existing icons around. But either of those do not work for red-green colorblind people, which reduces accessibility. If they are used, I recommend a colorblind set of icons as well.

There's also the safebox icons to consider, but I'm a little concerned that they are too detailed.

@sanspace You mentioned using svg. Is that normal to use in this context? I looked at several extensions, and they all use png icons. SVG files have to be interpreted and rendered since they are XML. I'm interested in learning about why you are recommending them for use in this context. I hope to learn something new.

Polite as always!

No confusion with Firefox's native SSL lock icon

You have a 👍 for that.

@Gitoffthelawn

@Gitoffthelawn You make some excellent points. I believe in community feedback. That's why I let you and @Atavic make the decision. Makes my job easier! 😉

A word on 4th point. I am from India. 98% switches there differ from the up is on, down is off model. I am not sure what's the case around the world. Just a trivia! 📝

I am no expert on SVG either. However, I had to use different sizes for PNGs. An icon for 16x16 and another for 32x32 and so on. However, SVG scales and a single file does the job. So, far the icon is behaving good on different platforms and sizes I hope. I am just trying out SVG for this project so I'll get to know more about it.

You really make opensource a better world! Respect!

I like the simplicity of your webextension. I dumped HTTPS Everywhere by EFF.

@Atavic

@Atavic 😃

@sanspace I was concerned about #4 for exactly that reason. I had done some research on light switches around the world, and most that I found (including in India) use an up/down model. Some use a left/right model, but they seem more rare. It sounds like your experience is different. What's your experience?

Regarding SVG vs PNG, yes, multiple sizes are often necessary for PNG. I started work on the other sizes, but wanted to submit a single size for review before spending all the time making the different sizes.

SVG is a very interesting idea, especially given how easy it is to make gradients. I just don't know if it's more or less work for Firefox. I'm thinking/hoping that once it gets rendered at a particular size that Firefox is smart enough to not render it again during the session.

@Atavic @sanspace It's a pleasure working with you both as well. 😃

The patch has been approved by AMO. It should be available in the AMO site now.

These are the switches I've been used to.

Sockets without switches next to them was a new thing when I came to US. As I said, it's just a trivia. Don't give much attention to it. 😄

The switches actually control the socket, correct?

Got the update BTW.

The ones next to a socket, yes. Others might be connected to lights / fans etc.

Navigation Menu

Repository navigation

Let's rethink the new icons #6

10 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Let's rethink the new icons #6

Description

Activity

sanspace commented on May 22, 2017

sanspace commented on May 22, 2017

Atavic commented on May 22, 2017

Gitoffthelawn commented on May 22, 2017

sanspace commented on May 22, 2017

Atavic commented on May 22, 2017

Gitoffthelawn commented on May 22, 2017

sanspace commented on May 22, 2017

Atavic commented on May 22, 2017

sanspace commented on May 22, 2017

Atavic commented on May 22, 2017

pyllyukko commented on May 22, 2017

Thorin-II commented on May 22, 2017

10 remaining items

Gitoffthelawn commented on Jun 22, 2017

Gitoffthelawn commented on Jun 22, 2017

Atavic commented on Jun 22, 2017

sanspace commented on Jun 22, 2017

sanspace commented on Jun 22, 2017

Gitoffthelawn commented on Jun 22, 2017

Atavic commented on Jun 22, 2017

sanspace commented on Jun 22, 2017

Atavic commented on Jun 22, 2017

Gitoffthelawn commented on Jun 22, 2017

sanspace commented on Jun 23, 2017

sanspace commented on Jun 23, 2017

Gitoffthelawn commented on Jun 23, 2017

sanspace commented on Jun 23, 2017

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions