0

There are many important technologies coming to web browsers in the next few years. Not to mention that where we are today is a culmination of lessons learned and several security pitfalls.

However, as security progresses, and time goes on, users have the same red/green "lock" icon that (sometimes incorrectly) that the security is fine. Most users take this as a comprehensive "I'm OK" icon and move on and sometimes get their identity stolen, or even worse, reporters for human rights in Iraq/Iran are hacked, located and physically attacked.

I'm suggesting a wild idea; What if we were to include a date, or some score alongside or within the lock icon that can give users some context regarding their security?

Here is how it could play out: Suppose a website is never maintained, and uses technology from 1998. Hackers then target it for attacks... then perhaps it should say "1998" near the lock icon.

Perhaps it could be inspired by the windows rating system:

Sample rating of a windows machine's capabilities

Sure this is just an outline of an idea, and would require the co-operation of bigger players, but what do you think of it?

Please note! I revised this question significantly.

Many answers below are regarding a "geek indicator" I originally wanted. Yep that was a bad idea! I was using the wrong lingo with the wrong crowd. Designers aren't usually geeks, but programmers like myself are.

I'm posting this here among designers to raise awareness of the cat-and-mouse game between hackers and security professional. Both sides have to improve their tools, and users should be able to have a fair say in what happens beyond their control.

Besides, if we had the icon enhancement I'm dreaming of, then maybe we could have eliminated legacy browsers, long ago because end users would demand safety and security. Just imagine how much CSS work that would save you. (yes I'm buttering you up)

Improve this question
3
  • 1
    Honestly you're asking a totally different question now. And for the second question I would give a flat no, as that information is all but meaningless to the great majority of users, while at the same time complicating the "secure" icon immensely.
    – Zelda
    Commented Sep 26, 2011 at 3:05
  • While this is certainly an interesting thing to ponder, I'm not sure I know what you are asking.
    – DA01
    Commented Sep 30, 2011 at 2:57
  • also, for a site to be secure, it needs a security certificate. If a site hasn't been maintained in 14 years, the certificate is likely expired and the browser should warn you as such.
    – DA01
    Commented Sep 30, 2011 at 2:58

3 Answers 3

Reset to default
4

Perhaps an additional 'tick' symbol on top of the existing padlock? This way, users will see the green and red padlocks still represent what they always did, but this additional verification symbol represents, quite naturally, an additional level of security.

Improve this answer
1
  • 1
    I like this much better than the green URL bar solution as the indicator is directly on the SSL identification; since they're physically connected there's no need to determine connectivity between green URL and how "right" that padlock icon is.
    – Zelda
    Commented Sep 25, 2011 at 15:02
3

From user's perspective that makes no sense at all. DNS/SSL/domain/certificates etc, user does not know about any of these. He is interested in the answer to one question:

Will the data I transfer in my current session reach to correct website without being seen by unwanted parties?

also widely known as:

Am I secure?

DNSSec itself is not enough to answer that question. You can be secure without DNSSec and you can be "phished" WITH DNSSec too. Even "extended validation" etc doesn't mean much. User has no notion of weighting for these individual sub-technologies, protocols. User will not demand them. User will not demand DNSSec either unless it's part of a mandatory access criteria.

From my perspective DNSSec is a low-level security operation, such as IPSec. It's not relevant to the web browser or a single session since you are always using the same DNS server for all web sites. So, any failure in compliance to DNSSec is OS's problem and should be indicated by a bang on the network icon if it's marked as required. Or it could even be a reason to prevent interrogating that DNS server further. But web browser has nothing to do with it.

Note: I don't know much about DNSSec but my idea is clear: That icon should be a clear-cut answer to the question above. Any other intermediate states are confusing and far from being helpful at all.

Improve this answer
5
  • See this link, it says even if you're using SSL you're not secure unless you also use DNSSec. Yes, DNSSec is per session. Furthermore, given that HTTPS is a port change, the encryption aspect of SSL could be seen as low-level security detail. If we carry the analogy further, we shouldn't show the lock, nor the green bar.
    – makerofthings7
    Commented Sep 25, 2011 at 15:30
  • See my last paragraph after edit.
    – Sedat Kapanoglu
    Commented Sep 25, 2011 at 15:58
  • I agree with your answer completely: users only want to know the simple answer. But I see one problem... there IS no clear-cut answer to security type questions. Security needs aren't always the same, and security answers not always simple. Which sucks, but that doesn't make it any less of a reality.
    – Inca
    Commented Sep 25, 2011 at 19:26
  • 1
    That's true @Inca, but if someone needs to do the weighting the worst choice is the user. User should still see a green or red only.
    – Sedat Kapanoglu
    Commented Sep 25, 2011 at 19:45
  • I do agree it needs to be simple, and that security is always evolving. I don't think that only red or green is the appropriate choice... I mean we've had this icon/behavior for 15 years now. So much has changed, and users are being deprived of their ability to know. I've changed my perspective a little and will update the question.
    – makerofthings7
    Commented Sep 26, 2011 at 1:59
1

The problem is that, while this is a new technology, it needs to be quite subtle. Changing the padlock image is a good idea, but there is a danger that people will see this and think that there is a problem, because the icon does not look like it normally does.

I think the Chrome sample is pretty good and does a good job. Maybe the real answer is to insist on DNSSec security for all standard Https connections? Or maybe a subtler change to the padlock - maybe a more 3D look or something, which is noticable to those who are interested, but to others will still look like a padlock and give people confidence who just glance at it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.