As of today’s nightly firefox build, we’ve turned on EV support and activated the Verisign EV root for testing purposes. What this means is that when you go to sites that have Verisign-issued EV certificates like, say, British Airways, the site-identity button (shall we call it Larry? Yes. Let’s.) will pick up the name of the site owner, all green-like.
I rather suspect this might startle a few of you.
I’ve talked a lot about identity and security in Firefox 3, but some of the actual changes were easy to ignore if you weren’t looking for them. The site button has been around for a while, with Larry telling you what he knows about a site, but you could choose not to click on him, not to get that information. A while ago, I mentioned a way to get the EV behaviour ahead of schedule, if you wanted to test, but now those steps are no longer necessary.
So things are going to feel a little weird for a few days. There are about 4000 EV sites these days (the AOTA has a pretty long list) so you will probably hit a few, and it will probably feel weird. By all means, open bugs. The whole reason we’re doing this is to get more sunlight on the code, because it’s required weird custom builds and secret handshakes for too long.
The story goes that when London first introduced street signs, there was significant protest. They were gaudy, the argument went, and anyhow the locals already knew where they were going. Many streets in London still don’t have them. I’m excited about getting feedback into the UI to help users know better who they’re dealing with online, help them orient themselves, and rebuild some of the cues that we all take for granted in the real world. But like the London signposts, I suspect it’ll take some getting used to. Especially on Proto. Where it currently looks, as Shaver so eloquently puts it, like the South end of a North-facing horse.
meandering wildly 
From your earlier posts regarding EV certs, you seems to be against the “green means go” design. What made you change your mind?
I haven’t tried anything past FF2, so maybe this is dumb. In the screenshot, there is a big popup with Larry-the-passport-reader and no apparent way to make it go away. What is the actual behavior? If this thing pops up automatically, shouldn’t it have an X button or something to make it obvious how to get it out of your way? Or do you only get that from a right click like a context menu or something, so it goes away whenever you take focus away?
@Travis
I have only FF3B2, but I believe that you have to left click on the green area to bring Larry up and left click on the green area again to make Larry go away.
Hi Johnathan,
[Tone: Non-confrontational, “what did I/we miss?”]
Apologies if I haven’t been following closely enough, but what’s the rationale behind only turning on VeriSign roots for this testing phase? I’m sure you can imagine that it causes me and others great sadness.
Best regards,
Andrew
PS:
This makes it sound like inclusion is based on NSS asking for a root to be included temporarily:
http://groups.google.com/group/mozilla.dev.tech.crypto/browse_thread/thread/220d1e49e7c4479c/d24ea1658b6a942f
This makes it seem like we’re (Entrust) in good stead for inclusion, even in this temporary testing phase:
https://bugzilla.mozilla.org/show_bug.cgi?id=382352
Do we just need to send someone in the NSS group cookies?
Site identity button: Nice!
Larry: Nice!
Extended Validation racket: Ouch!
“Green means go”, in direct contradiction of previous discussion: Ouch!
I personally see no added value in Verisign’s EV certificates over a standard SSL certificate, and I see no value in those other than validating that the other end of the connection corresponds to the URL the user provided (which does not mean the same thing as “where they wanted to go”).
Firefox should do everything possible to make sure that the user knows what site they visited. This includes helping them distinguish chrome from site content, showing the site identity prominently, flagging phishing sites, and other such features. However, don’t penalize secure sites which haven’t bought into Verisign’s racket.
“However, don’t penalize secure sites which haven’t bought into Verisign’s racket. ”
i could not agree more. i just tested* our secure shop site (standard Thawte SSL) and Larry tells me “unverified”. Ouch – for John Q. that’s not much different from “untrusted” or “these guys might not be legit”.
(*Yesterday’s nightly)
I think those decisions deserve to be discussed more widely where adequate, that is either news://mozilla.dev.security or news://mozilla.dev.tech.crypto.
Especially since as already noted, they don’t really go in the direction that was hinted before.
I support Marc Hoffman’s opinion, it will be a huge difference in user experience whether the site is EV or not, commerce site will have no choice but to update.
I’m not saying this is bad, just that it fells like more debate and more exposure of the rationals would be good.
Hi Jonathan: Recall I am the technical director for the team that developed the EV Green Bar extension for FF2 here at VeriSign (https://addons.mozilla.org/en-US/firefox/addon/4828). I was doing some testing this evening with FF3.0b3 and I could not get it to display in the manner your have a screenshot above using the same reference site. Is there some option I need to enable? I can see that the root is there but it is not displaying the green in the address bar.
Also I have another question I’d like to ask offline if you could reach out to me.
Thanks!