Comments on: Will Firefox have a Green Bar?

By: Browsers and secure sites « Arnoud on Software Development

Browsers and secure sites « Arnoud on Software Development — Mon, 03 Nov 2008 08:12:16 +0000

[...] Some more reflections on the validity of the greenness in the browser address bar in will firefox have a green bar. [...]

By: SecurityFocus Interviews Mozilla Security Team | Infosecurity.US

SecurityFocus Interviews Mozilla Security Team | Infosecurity.US — Tue, 24 Jun 2008 07:08:24 +0000

[...] has published a superb interview with a couple of members of the Mozilla Security Team (actually Johnathan Nightingale, Security User Interface Lead (aka HumanShield) and Window Snyder, Chief Security Officer). The [...]

By: Security Hype 7.6-SiteKey (not) broken and Mozilla’s radical Security UI idea — Security Hype

Wed, 26 Mar 2008 05:39:00 +0000

[...] is not about encryption, it’s about identity of the website you’re connecting to. Is the Lock Icon going away!?! Will this actually work and protect users on the Internet? Does this make sense? Send us your [...]

By: Intraplanar.net

Intraplanar.net — Thu, 21 Jun 2007 18:11:33 +0000

Website identification in Firefox 3…

Johnathan Nightingale recently presented his work on making website identity more transparent (and less confusing) for Firefox users. I downloaded his prototype extension to see for myself exactly where he was headed and I ended up becoming much more i…

By: Iang

Iang — Thu, 14 Jun 2007 05:56:24 +0000

Brian brings up some good points. Now that browsers are working to state the name of the CA, we can expect much more scrutiny of who the CA is. This more than anything will move the PKI industry to a sense of quality, to a desire to establish its brand, and to show it is good enough for the job, not just fill in some dry auditing documents so it can get on and sell certs.

Brian, bear in mind that before now, the CA’s name and thus its role and quality was hidden. If you think that Mozilla made mistakes in its root list, then I’d suggest mistakes can only be fixed if they can be seen. Browsers can expect to hear a lot more noise and face a lot more scrutiny on CAs if and when the brand is surfaced: if anyone sees a strange name, then they are motivated to investigate and comment, either positively or negatively.

It’s not reasonable for us to expect a browser to get it right every time, but if mistakes are hidden, nobody is encouraged to help. (Disclosure: I audit a CA.)

By: Brian Smith

Brian Smith — Thu, 07 Jun 2007 21:25:32 +0000

* Your example doesn’t look so bad when you use VeriSign, Inc. As people knowledgeable about computer security, we all know who VeriSign is. But, what about “Verified by ABA.ECOM,” another CA included with FireFox 2? Who the heck is ABA.ECOM? I think that Mozilla made a big mistake by being so lenient with which CA’s are trusted by the browser. Firefox 3 is a good time to revisit this policy, and create stricter criteria for what it considers to be sufficient verification of identity. Mozilla can do this independently of the EV cert consortium.

There is also the question of _when_ the CA verified the identity of the site. The EV guidelines state that certs last 12-18 months, IIRC, and the CA is only required to re-verify the identity of the website owner (not operator) once per year. That is a long time in Internet time.

Your stance against “Green means go” with respect to EV certs is right on. I have read through the EV requirement drafts. The EV verification requirements are heavily weighted favor of larger businesses. In fact, as of the current standards, ONLY corporations (not small businesses, and not sole proprietors or individuals) qualify. Furthermore, the EV verification process does nothing to verify the identity of the hosting providers or the payment processors for a website. A company could have an EV cert for a website that is running on a machine owned and operated by convicted thieves and still qualify, as long as said company has a phone that they answer in a businesslike manner–yes, that is what the EV requirements say!

I think that every EV cert should include a statement from the domain owner stating their privacy and security guidelines, and what procedures they have gone through the verify the statement (WebTrust-like audits, etc.) This would be analogous to the CA’s CPS statement, but user-oriented (i.e. not 200 pages of jargon). It would be signed (cryptographically) by the CA and the website, and firefox would retrieve it on demand. If the statement is missing, Firefox would say “The identity of this website was last verified on July 21, 2006 by ABE.ECOM. Neither ABE.ECOM nor the owners of this website have provided any assurances regarding the content of this website, your privacy, or anything else regarding the safety of using this website.” An abbreviated form of the CA’s CPS statement should be included as well–especially the parts where they disclaim any and all liability and refuse to warrant the service they provide.

This takes away a considerable amount of responsibility from Mozilla and give it to the CA and the website operator, the CA, and whoever Mozilla delegated CA verification to (WebTrust?). Then, Firefox just needs to include a single “How Safe is this Website?” button to show what the Website said, what the CA said about the Website, and what Firefox and/or Webtrust had to say about the CA. Which all boils down to, approximately, “nobody promises anything about anything.”

By: Gerv

Gerv — Thu, 07 Jun 2007 14:52:20 +0000

I really like the idea of Larry being a top-level button, the same size and shape as the Home button. He could be between the URL bar and the Search box, so he’s highly visible all on his own, and he’s a fair way to the right so his dropdown doesn’t obscure too much.

By: Dan Veditz

Dan Veditz — Wed, 06 Jun 2007 23:51:46 +0000

None: put Larry (and the verified domain if any) on the left side of the location bar where people will see him. Put him _outside_ the location bar into the chrome (that is, NOT Buh) so people can’t try to spoof him with favicons as you’re spoofing the lock icon with your blog.

By: Stevo

Stevo — Wed, 06 Jun 2007 17:09:16 +0000

Also, I assume this is the EV cert presentation. What happens when a non-EV cert is shown?

By: Stevo

Stevo — Wed, 06 Jun 2007 16:59:56 +0000

Really helpful to test it out with the addon. It is too hard to see the question mark and the check mark. A simpler Larry might be better, but then would he be Larry or just some guy?

Personally I like the green bar, but I also liked the dancing banana idea.