The number one question I get asked, in my capacity as Human Shield at Mozilla, is how we make any money. People ask it with a sort of knowing grin, as though they already know we get it from leprechauns, but they want to hear me admit it. That’s not what this blog post is about.
The second most frequent question I get asked, and the one I’m more directly positioned to answer, is whether Firefox 3 will have an IE7-style Green Bar. I’m going to try to answer that here by offering my opinion on the matter, and an update on my coding progress to that end.
The short answer to that question is: no.
The longer answer is: it is not my preference to do so, though I recognize that, in order to aid in user education, we will have to find SOME consistent visual presentation across browsers. I just don’t think the green bar is the right one.
I don’t want to rehash my concerns with the green bar here, you can read all about them in this post. Suffice it to say that the green bar blurs the line between security and identity. An Extended Validation certificate tells us, with more certainty than any other web technology out there, who you are. It does not tell us that you’re a nice person. Identity, not security. The green bar also, like the padlock before it, relies on users noticing when it’s not there. If my life were a bumper sticker it would say:
Absence: good for hearts, bad for security UI.
What I’d like to see, instead, is a cue that focuses on identity. This is also not news to regular readers. Take safety out of the equation, we never could tell you that anyhow. An always-on identity indicator that doesn’t blur the lines.
Remember this guy? I called him Larry back then, and it’s stuck. Instead of using a colour, always tricky since the popular ones tend to be pretty culturally-dependent and semantically overloaded, I suggested using a freely available icon with a pretty singular meaning: inspection of identity documents.
At the time, I also posted an unfortunately poor photoshop mockup that looked like this:
Since then a lot of things have happened, and my time has been split in a bunch of ways, but Larry hasn’t left my mind. I now have a Firefox add-on that implements Larry and he looks, for the moment, like this:
Finally, for comparison, here is what IE7 looks like on the same page:
Now, call me a Canadian if you must, but I see a lot of common ground here. We both tell the user the name of the site’s owner, and who verified that information. We both try to include some meaningful location data, where it’s been specified, and we both provide some indication that this represents a successful identity verification.
IE7 links to some help documentation behind “Should I trust this site?” and to their certificate viewer “View certificates” whereas we link to the updated Security Info dialog, but once again are both providing some way to drill down and get more information.
Our differences are pretty minor, when you think about it. Colour signal vs. icon signal; intermittent signal vs. persistent; and some minor differences in language and presentation. But still, it matters.
We’ve spoken to Markellos Diorinos at Microsoft about including Larry in their presentation as well, and he didn’t immediately reject the idea. I think it would be a big win for the end user, but I’m not so long gone from IBM that I’ve forgotten the speed at which such things move. Markellos and his colleagues are good guys, but they may well have an uphill struggle on such things, so cross your fingers for them.
In the meantime, we have work to do, as well. I need to finish implementing the front end, and eventually tie it in to the work already being done on the back end to recognize EV certificates. And there are still questions…
Should we talk about encryption in Larry’s popup? How do we approach sites that offer encryption, but not strong identity information? And where, oh where, do we put him?
Putting Larry in the address bar means making it even more crowded than it already is. Putting him outside in the space between location bar and search bar gives him more room, but makes him float sort of confusingly out in space. We don’t often introduce new pieces of primary UI, so it’s always a little bit touch-and-go when we do.
This is somewhere that I could use your help. Probably the single biggest thing you can do to help is install the current version of Larry from the addons sandbox. You can provide feedback here, or in the tracking bug. I look forward to it. Adding something to primary chrome is a big deal, especially something security-related. I’m going to try pretty damned hard to get it right.