Iceraven-browser: Show security details for certificates in or accessible from the panel that appears when you tap the lock icon
What is the user problem or growth opportunity you want to see solved?
Currently fenix does not show the true security details of the website like cipher suite, tls version etc... This shows in Firefox desktop and other chromium based mobile browsers... So if possible add the website security details in one line
How do you know that this problem exists today? Why is this important?
Currently it does not show any security info of the website
Who will benefit from it?
All users
sheikh-azharuddin
All 2 comments
Clicking on the lock icon actually doesn't even appear to show who the certificate was issued to, just who it was issued by, and instead of showing the company or individual it was issued to, it includes the URL and page header as if that is telling us something the URL bar doesn't (To be fair, on Firefox for Android, it is telling us something the URL doesn't because the Firefox URL bar omits full protocol and "www" in the bar, something Iceweasel/Iceraven gave users the option to restore very early in its development, which I am appreciative of. However, Firefox's truncated URL bars are not something it should be at all proud of IMO- I could tolerate it until Fenix came along and I couldn't even opt in to see the full URL anymore. Iceweasel/Iceraven saved me as a user of the underlying Gecko web engine when it comes to my Android web browsing.).
I agree with the suggestion above, and would at minimum like to see the certificate issuee restored even if the more detailed security information can't be. Really, I don't see any reason, other than potential coding issues, why all of it wouldn't be included, though.
By clicking the lock icon, the user is already indicating that he or she wants additional security related information about the webpage he or she is viewing, and there is enough room to do it once that new area has been opened that displays the certificate issue, so there is no real reason not to put as much there as possible. Arguably, not every line would be useful or comprehensible to a lot of users, but it could be organized with the easiest to understand most familiar information up top and the further you descend, the more technical it gets. The user could stop at the point he or she no longer understands what he or she is seeing, or look it up and learn something instead, at each user's individual discretion.).
I've always felt like part of the mission of a web browser was to provide the user as much information about what was happening between the browser, the server, and everything in between as possible, and enable the user to have as much control over that transaction in terms of what is sent and received, and how it is displayed and can be interacted with as possible.
One of the lasting negative impacts Google Chrome has had on the browsing experience is that it has decided in some respects that the user really doesn't need and shouldn't have access to information, and that it should be displayed as either the content provider or Google dictates based on whatever is perceived to be best for business or what is perceived as what the user should want. We're going to back to AOL keywords in place of the World Wide Web as we knew it within a decade or two on the outside if Chrome continues to move in the direction it's moving and dictates not only what its own browser does, but also the other browsers that rely on its code, or, a step less directly, other browsers that perceive it as popular and trendy and love to copy its design if not it's underlying technology, not to mention the effect that has on web design, both defacto and written web standards, and the way the Internet works at a basic level.
There's nothing wrong with a browser that works easily for everyone and doesn't overwhelm people with a ton of information they may prefer not to have to process, but there should always be easy options and very accessible ways to know more, learn more, and control more, for those who want it occasionally or more than occasionally.
I suppose one of my hopes for Iceraven is that it'll be that browser on mobile. It's already done a lot of great stuff in that department in a relatively short time. And I think it still works for regular people, too.
The design decisions that Mozilla made when they launched Fenix as the stable Firefox release to kind of dumb everything down were pretty shocking to me, because Mozilla, while sort of drifting towards "less" in some respects since as early as desktop Firefox 4 or 5, was still sort of the last bastion against that sort of thing, especially on mobile.
Iceraven of course had to take Fenix as it was and gradually work on turning it into the type of browser many of us hope it can be, and do so with limited resources. And as much as I include what I would like to think of constructive criticism of Mozilla and Firefox in this post, I am very aware that Iceraven needs them to do what it does, because one can't really develop a complete browser from scratch, it has to be forked from something (the rendering engine at minimum) or even maintain it independently without transferring over fresh code from elsewhere on a regular basis without being an extremely large well-funded corporation. And overall Mozilla, Fenix Firefox, and Gecko are a much better base and source of ongoing code to do something like this than Google, Chromium, and Blink are.
I did also notice that someone from Mozilla popped by and talked about using some code developed for and instituted in Iceraven's tabbing system, which I think is a great demonstration of how this kind of fork can be beneficial to both users of the fork and users of the upstream project. It's not just a question of downstream taking advantage of upstream, but of downstream providing a wealth of new code and ideas, as well as increased usershare of their rendering engine and other assets, that they can take from as freely as they want, at their own discretion. That's got to be a helpful option for a division of Mozilla that is rumored to only have six full-time developers on payroll.
One of the nice things about open-source is that in theory we can all help each other out because everyone's code is available to everyone else under the same licenses.
TL;DR: I agree with the first poster. First three paragraphs are mostly focused on this issue. Then I broaden it to a discussion of design and development principles after that. :)
CharmCityCrab
on 20 Sep 2020
We could definitely stand to expand that dialog, ideally with a full certificate description. Maybe if you tap it or swipe it open?
Clicking on the lock icon actually doesn't even appear to show who the certificate was issued to, just who it was issued by, and instead of showing the company or individual it was issued to
I think the more detailed recipient info like you used to get with Extended Validation certificates was made less prominent for security reasons. It was too easy for people to do things like incorporate a company called "Identity Verified", or even with the name of a more prominent company incorporated in a different state. Certs really only prove you have the right domain, so we shouldn't add recipient info beyond the domain outside of a full details view, I think.
interfect
on 23 Sep 2020
Related issues
ale82to
路
9Comments
Leviafan83
路
8Comments
CharmCityCrab
路
7Comments
Maji78
路
3Comments
aquaspy
路
10Comments
Most helpful comment
Clicking on the lock icon actually doesn't even appear to show who the certificate was issued to, just who it was issued by, and instead of showing the company or individual it was issued to, it includes the URL and page header as if that is telling us something the URL bar doesn't (To be fair, on Firefox for Android, it is telling us something the URL doesn't because the Firefox URL bar omits full protocol and "www" in the bar, something Iceweasel/Iceraven gave users the option to restore very early in its development, which I am appreciative of. However, Firefox's truncated URL bars are not something it should be at all proud of IMO- I could tolerate it until Fenix came along and I couldn't even opt in to see the full URL anymore. Iceweasel/Iceraven saved me as a user of the underlying Gecko web engine when it comes to my Android web browsing.).
I agree with the suggestion above, and would at minimum like to see the certificate issuee restored even if the more detailed security information can't be. Really, I don't see any reason, other than potential coding issues, why all of it wouldn't be included, though.
By clicking the lock icon, the user is already indicating that he or she wants additional security related information about the webpage he or she is viewing, and there is enough room to do it once that new area has been opened that displays the certificate issue, so there is no real reason not to put as much there as possible. Arguably, not every line would be useful or comprehensible to a lot of users, but it could be organized with the easiest to understand most familiar information up top and the further you descend, the more technical it gets. The user could stop at the point he or she no longer understands what he or she is seeing, or look it up and learn something instead, at each user's individual discretion.).
I've always felt like part of the mission of a web browser was to provide the user as much information about what was happening between the browser, the server, and everything in between as possible, and enable the user to have as much control over that transaction in terms of what is sent and received, and how it is displayed and can be interacted with as possible.
One of the lasting negative impacts Google Chrome has had on the browsing experience is that it has decided in some respects that the user really doesn't need and shouldn't have access to information, and that it should be displayed as either the content provider or Google dictates based on whatever is perceived to be best for business or what is perceived as what the user should want. We're going to back to AOL keywords in place of the World Wide Web as we knew it within a decade or two on the outside if Chrome continues to move in the direction it's moving and dictates not only what its own browser does, but also the other browsers that rely on its code, or, a step less directly, other browsers that perceive it as popular and trendy and love to copy its design if not it's underlying technology, not to mention the effect that has on web design, both defacto and written web standards, and the way the Internet works at a basic level.
There's nothing wrong with a browser that works easily for everyone and doesn't overwhelm people with a ton of information they may prefer not to have to process, but there should always be easy options and very accessible ways to know more, learn more, and control more, for those who want it occasionally or more than occasionally.
I suppose one of my hopes for Iceraven is that it'll be that browser on mobile. It's already done a lot of great stuff in that department in a relatively short time. And I think it still works for regular people, too.
The design decisions that Mozilla made when they launched Fenix as the stable Firefox release to kind of dumb everything down were pretty shocking to me, because Mozilla, while sort of drifting towards "less" in some respects since as early as desktop Firefox 4 or 5, was still sort of the last bastion against that sort of thing, especially on mobile.
Iceraven of course had to take Fenix as it was and gradually work on turning it into the type of browser many of us hope it can be, and do so with limited resources. And as much as I include what I would like to think of constructive criticism of Mozilla and Firefox in this post, I am very aware that Iceraven needs them to do what it does, because one can't really develop a complete browser from scratch, it has to be forked from something (the rendering engine at minimum) or even maintain it independently without transferring over fresh code from elsewhere on a regular basis without being an extremely large well-funded corporation. And overall Mozilla, Fenix Firefox, and Gecko are a much better base and source of ongoing code to do something like this than Google, Chromium, and Blink are.
I did also notice that someone from Mozilla popped by and talked about using some code developed for and instituted in Iceraven's tabbing system, which I think is a great demonstration of how this kind of fork can be beneficial to both users of the fork and users of the upstream project. It's not just a question of downstream taking advantage of upstream, but of downstream providing a wealth of new code and ideas, as well as increased usershare of their rendering engine and other assets, that they can take from as freely as they want, at their own discretion. That's got to be a helpful option for a division of Mozilla that is rumored to only have six full-time developers on payroll.
One of the nice things about open-source is that in theory we can all help each other out because everyone's code is available to everyone else under the same licenses.
TL;DR: I agree with the first poster. First three paragraphs are mostly focused on this issue. Then I broaden it to a discussion of design and development principles after that. :)