New LE logo? /s

@mholt

I'm thinking a campaign to lobby browser developers regarding clarity and trust when it comes to presenting information regarding certificate usage would be interesting. I think the industry's heart is in the right place. I'm just not sure they're collectively arriving at the overall most effective design pattern. As you intimately know, it's a complex concern with a rocky history. I feel like there's just got to be a way to arrive at a solution that addresses the collective concerns. IMO standardization of actual implementation (or rather, expected visitor behavior) would certainly help. :thinking: I've initially thought of seemingly silly ideas like replacing the padlock icon with a certificate icon. I felt that it would break the existing associations (and bad assumptions) with the padlock and more closely convey the intention. I know it's mostly symbolic and semantic, but it's where I started. When I get a chance in the near future, I plan to read through your thesis. Should provide nutrition for thought.

6 Likes

A lot of the push back from folks both for this and for things like cert lifetime shortening seems to revolve around timing. The folks pushing back think it's too soon and we (the global we) are not ready yet.

As stated in the blog post, the Chrome UX team believes working HTTPS (all facets, not just the cert) are now ubiquitous and common enough that taking up screen space with an HTTPS-OK indicator is superfluous. So the UX indicators are only needed when there's a problem. @griffin, I'm curious if you agree with the premise but not the timing or whether you disagree with the premise entirely.

I lean towards agreement with them. But obviously, time will tell whether it was a good one. There will also be the inevitable period of confusion as different browsers on different OSes continue to make different decisions. But you can't really avoid that even if every browser developer decided to make the same decision in unison. Waiting 5-10 years won't make that any easier because as we all know, a whole lot of folks either can't or won't ever update their devices.

4 Likes

That's a very reasonable question. :thinking: I feel that thoughtless, inherent incorporation of certificates into the average production system has not yet reached the stage of being able to adequately compensate for the lack of knowledge/maturity of both average deployers and average users necessary to relegate certificate concerns to the background.

4 Likes

Since certificate usage is always BOTH a client and server affair, there will likely always be expectations and compatibilities to manage. As a result, no matter how automagically-well-configured both sides may be, there will likely always be room for doubt, which is unacceptable to ignore/sideline when it comes to fundamental security.

4 Likes

I think the new Chrome logo is forking stupid and shortsighted, like many things that company does.

4 Likes

Doesn't one need a Turtle :turtle: for Logo? :slight_smile:

4 Likes

Didn't Google also develop Go? Nuff said.

4 Likes