Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Update on the Lock Icon

blog.chromium.org

Post reply on HN
Print view View original

81–90 of 169 posts

Re: An Update on the Lock Icon

#81

Post by rootusrootus »

yamtaddle wrote: post #78
rootusrootus wrote: post #71

While we're fixing the UI for SSL, can we do something about unsecure connections to devices on my home network? At best I get a huge security warning that makes me jump through hoops to get past it, sometimes Chrome won't even let me get past without knowing the secret code. Surely we can figure out how to tell that a connection is only on the local network, and then give the user a one-time option to not worry abou…

I think the concerns/difficulties are: 1) Business contexts. A local network maybe shouldn't be trusted, there, for security purposes. "OK, but they should set that with policies" which, yes, sure, but defaults do matter, so... I dunno, I can see why they'd prefer the safer default. 2) Lying DNS servers on a local-but-actually-public network (think: coffee shop wifi) directing you to a local address to bypass SSL pro…

I agree there are things that would have to be worked out, to prevent opening new exploitable holes. How about we just add some ability to the browser to remember the site (fingerprint it somehow, perhaps) so that the security policy only has to be agreed to once. Kinda sorta similar to SSH remembering known hosts. Once I've told Chrome that my Unifi Dream Router is okay, or my Iotawatt, or Home Assistant, etc ... it should stop making me jump through hoops every time until something changes. And I don't ever want it to flat out tell me no, I cannot reach something on my home network with a low quality SSL implementation unless I blindly type "thisisunsafe" into the security window.

It's a pet peeve of mine, as you may have noticed. I have a lot of little random devices on my home network and many of them have no way (or no simple way, at least) of protecting with a real SSL certificate. Sometimes I'll go through the trouble of using nginx as a reverse proxy to hide the insecurity, but that isn't always easy to get working either.

Re: An Update on the Lock Icon

#82

Post by jeroenhd »

matthewaveryusa wrote: post #2

"You know that green lock in your browser?" used to be how I explained what I did in 5 seconds. Now what am I supposed to do?! I like this update, I think this is an excellent UX change

"Click the button that looks like two magnifying glasses pointing left and right" clearly!

I get what they were going for with this design, but it's impossible to describe this over the phone. I guess they want you to use Chrome Remote Desktop if you ever need to support someone remotely.

Re: An Update on the Lock Icon

#83

Post by at_a_remove »

politelemon wrote: post #10

Reading through this it's making a lot of sense, the lock icon was added to convey that the 'connection is secure', while making the assumption that the user understood it's talking about the transport layer behind the scenes. Of course, most users cannot be expected to know that kind of detail, so they would associate it with the thing in front of their eyes, the website itself. I am sticking to Firefox but as chang…

When we were hosting custom websites for various university departments on the cheap, at this point it was difficult to do HTTPS on a site that shared IPs (which I gather has been corrected). One group insisted on it, despite that their form results, which weren't exactly secret squirrel knowledge, got stuffed into plain ole SMTP emails. I explained this carefully.

"But it has a LOCK on it ..." It was impossible to get them to understand that SSL only protected one part of the movement of data. All they got was LOCK.

So, yes, I agree that the lock offers a kind of false sense of security to people who will latch onto that symbol even as the people providing the hosting tell them otherwise.

Re: An Update on the Lock Icon

#84

Post by cmckn »

p1mrx wrote: post #16

If you're using Chrome, right-click the URL bar and check "Always show full URLs", so you can see the https:// prefix like it's 1999. This also fixes a variety of UX problems with editing URLs. By the way, does anyone know of a good alternative to http://neverssl.com ? I had been using this for years, but now it supports SSL for some unfathomable reason.

http://www.alwayshttp.com

Re: An Update on the Lock Icon

#85

Post by function_seven »

reaperducer wrote: post #12
noja wrote: post #7

Earlier quoted context omitted.

The icon looks like something from audio equipment. I get it.

Aren't we supposed to hate skeuomorphism? I forget whether it's cool or not this week.

What icons have ever not been skeuomorphic?

I hate skeuomorphism when it's used wantonly, beyond the purpose of communicating how the UI works. Like that first version of the Apple Podcasts app that had a reel-to-reel animation¹, for example.

But icons... it's like the definition of the term.

> I forget whether it's cool or not this week.

I think it might be trending upward again. We all hated it in 2012, then the pendulum swung so far toward "flat design" that I (we?) would love to have too much of it again, if the alternative is not enough of it.

[1] https://www.flickr.com/photos/atmasphere/8320805931/

EDIT: Just thought about it some more and realized some icons are good abstractions of a non-physical thing. Play, Pause, and the rest of audio controls, for example. And of course Back and Refresh are just arrows.

But for something like "settings", or "info", you're going to have to draw some sort of picture for that. Gears and lists of sliders are two already-recognizable things that people know means "guts of the machine" and "control console panel thing".

Re: An Update on the Lock Icon

#86

Post by deathanatos »

yamtaddle wrote: post #79
andirk wrote: post #67

Earlier quoted context omitted.

San Francisco had a tsunami warning siren that was sound tested every Tuesday at 12pm for 30 seconds. It was fun! It needed repairs so they dumped it. Few weeks later there was the 1st tsunami warning in ages but it went thru telephone since they dismantled their warning siren.

Every week? Damn, that's a lot. We do once a month for tornado siren tests, where I am. And not all year, but of course tsunamis aren't seasonal.

Yeah, weekly. (Can confirm.)

I always felt like it sounded like it was saying "noooooooooooooooooooooooooooooon on a Tuesday" to me. Lunch time.

Also always felt like around noon on Tuesdays, we were completely vulnerable; if anything were to happen I would have heard the siren, and wandered outside looking for grub.

There is a subset of San Franciscans that do not hear the siren, too. On a pretty common basis we'd discover someone in the office who had "never heard the siren", somehow. I'm not exactly sure how. It's easily audible inside in the FiDi, and it was audible in the North Beach when I worked there.

Re: An Update on the Lock Icon

#87

Post by adrianmonk »

reaperducer wrote: post #12
noja wrote: post #7

Earlier quoted context omitted.

The icon looks like something from audio equipment. I get it.

Aren't we supposed to hate skeuomorphism? I forget whether it's cool or not this week.

There are plenty of settings dialogs that use a bunch of horizontal slider widgets to tweak values, so I guess it's not entirely skeuomorphism.

Re: An Update on the Lock Icon

#88

Post by CarVac »

aaronbrethorst wrote: post #49
amluto wrote: post #38

Earlier quoted context omitted.

I use example.org. An explicit http://example.org does the trick when needed.

Me too. Visiting the aforementioned URL is the only way I can consistently get captive portal login WiFi networks to work on my Mac. Amazing how busted this experience is...

Firefox always gives me a button that directly opens the portal login page.

Re: An Update on the Lock Icon

#89

Post by deathanatos »

Clamchop wrote: post #69
throwawaaarrgh wrote: post #53

Earlier quoted context omitted.

So as long as you're not color blind or vision impaired or from a country where red doesn't mean danger, sounds fine Government oversight of TLS certs? No way this could possibly go wrong

Traffic lights. Everyone everywhere knows red, yellow, and green now, and how to navigate around colorblindness (both red and green lights are tinted to be distinguishable).

Traffic lights are a combination of color and position; even if one is completely colorblind, the position of the lit lamp is sufficient to discern the signal.

The above suggestion doesn't have that sort of double-encoding of the data.

(This holds even for the odd horizontal signal, though I would expect most non-colorblind people would not be able to tell you the orientation from memory.

… and … there are plenty of drivers on the road who, judging from their behavior, would appear to be incapable of determining the color of the signal.)

Re: An Update on the Lock Icon

#90

Post by CharlesW »

djur wrote: post #30
CharlesW wrote: post #8

What's with the naming and visuals of the "tune" icon, which seems to be a "site settings" icon with weird left- and right-justified radio buttons?

"Tune" as in "adjust settings".

The mental model of "and here's where you tune the website" seems so strange to me, but thank you for the credible explanation!
Post reply on HN