Mozilla revamps Firefox's HTTPS address bar information
Mozilla plans to make changes to the information that the organization's Firefox browser displays in its address bar when it connects to sites.
Firefox displays an i-icon and a lock symbol currently when connecting to sites. The i-icon displays information about the security of the connection, content blocking, and permissions, the lock icon indicates the security state of the connection visually. A green lock indicates a secure connection and if a site has an Extended Validation certificate, the name of the company is displayed in the address bar as well.
Mozilla plans to make changes to the information that is displayed in the browser's address bar that all Firefox users need to be aware of.
One of the core changes removes the i-icon from the Firefox address bar, another the Extended Validation certificate name, a third displays a crossed out lock icon for all HTTP sites, and a fourth changes the color of the lock for HTTPS sites from green to gray.
Why are browser makers making these changes?
Most Internet traffic happens over HTTPS; latest Firefox statistics show that more than 79% of global pageloads happen using HTTPS and that it is already at more than 87% for users in the United States.
The shield icon was introduced to indicate to users that the connection to the site uses HTTPS and to give users options to look up certificate information. It made sense to indicate that to users back when only a fraction of sites used HTTPS.
With more and more connections using HTTPS, browser makers like Mozilla or Google decided that it was time to evaluate what is displayed to users in the address bar.
Google revealed plans in 2018 to remove Secure and HTTPS indicators from the Chrome browser; Chrome 76, released in August 2019, does not display HTTPS or WWW anymore in the address bar by default.
Mozilla launched changes in Firefox in 2018, hidden behind a flag, to add a new "not secure" indicator to HTTP sites in Firefox.
Google and Mozilla plan to remove information that indicate that a site's connection is secure. It makes some sense, if you think about it, considering that most connections are secure on today's Internet. Instead of highlighting that a connection is secure, browsers will highlight if a connection is not secure instead.
The changes are not without controversy though. For more than two decades, Internet users were told that they needed to verify the security of sites by looking at the lock symbol in the browser's address bar. Mozilla does not remove the lock icon entirely in Firefox 70 and the organization won't touch the protocol in the address bar either at this point; that is better than what Google has already implemented in recent versions of Chrome.
The following changes will land in Firefox 70:
- Firefox won't display the i-icon anymore in the address bar.
- Firefox won't display the owner of Extended Verification certificates anymore in the address bar.
- A shield icon is displayed that lists protection information.
- The lock icon is still displayed, it displays certificate and permission information and controls.
- HTTPS sites feature a gray lock icon.
- All sites that use HTTP will be shown with a crossed out shield icon (previously only HTTP sites with login forms).
Mozilla aims to launch these changes in Firefox 70. The browser is scheduled for a release on October 23, 2019.
Firefox users may add a "not secure" indicator to the browser's address bar. Mozilla, just like Google, plans to display it for sites that use HTTP. The additional indicator needs to be enabled separately at the time of writing, it won't launch in Firefox 70.
- Load about:config in the Firefox address bar.
- Search for security.identityblock.show_extended_validation.
- Set the preference to TRUE to display the name of the owner of Extended Validation certificates in Firefox's address bar, or set it to FALSE to hide it.
The new gray icon for HTTPS sites can be toggled as well in the advanced configuration:
- On about:config, search for security.secure_connection_icon_color_gray
- Set the value to TRUE to display a gray icon for HTTPS sites, or set it to FALSE to return to the status quo.
Now You: What is your take on these changes? (via SÃ¶ren)Advertisement