New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 655886 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug
Team-Security-UX



Sign in to add a comment

Standardize on the word "[not] secure" instead of "private"/"[in]secure"

Project Member Reported by lgar...@chromium.org, Oct 14 2016

Issue description

A virtual sticky note.

Visit: https://expired.badssl.com/

Page title: "Privacy error"
Page heading: "This page is insecure (broken HTTPS)."
Verbose security indicator: "Not secure"
Page info security summary: "Your connection to this site is not secure"
Security panel summary: "This page is insecure (broken HTTPS)."

I propose that we use "[not] secure" everywhere for consistency. I know there is a general UI effort around this, but I think the word "security" is important enough to warrant its own effort.
Thoughts/objections?
 
So, we could updating page title, page heading, security panel summary:

Page title: "Security error"
Page heading: "This page is not secure (broken HTTPS)."
Verbose security indicator: "Not secure"
Page info security summary: "Your connection to this site is not secure"
Security panel summary: "This page is not secure (broken HTTPS)."


@Adrienne -- I remember that "not secure" performed better than "not private" in the recent research. Did we think about updating the HTTPS warnings with the new string?
> So, we could updating page title, page heading, security panel summary:
> ...

Yep, those LGTM.

Comment 3 by f...@chromium.org, Oct 14 2016

Re #1: We found that "not private" performed better on the interstitials themselves in an earlier round of surveys. People were more likely to think the warning was about Safe Browsing when we showed the "not secure" string.
It sounds like that might matter for page title ("privacy error" vs "security error").

So Lucas, maybe we should do

Page title: "Privacy error"
Page heading: "This page is not secure (broken HTTPS)."
Verbose security indicator: "Not secure"
Page info security summary: "Your connection to this site is not secure"
Security panel summary: "This page is not secure (broken HTTPS)."

Comment 5 by f...@chromium.org, Oct 14 2016

I think Lucas put the wrong string in for page heading.

It's currently "Your connection is not private" and I'd like to keep it that way for now.
Yeah, that makes sense. I was just trying to change "insecure" to "not secure". Sounds like this is actually just in the security panel.
Yeah, "Page heading" in my first comment should have been "Your connection is not private". I pasted the wrong value due to  Issue 635656  (Regression: Can't copy from OSX interstitial page (again)). *sigh*

I'm sort of okay with using private for interstitials and "secure" for other stuff but I think it muddles our message:

- The verbose state "Not secure" shows up under a page title of "Privacy error" (shown in the tab strip).
- The page that calls itself a "privacy error" is called a "security warning" in Page Info

I can make a quick CL for DevTools, though.
Screen Shot 2016-10-14 at 13.46.19.png
201 KB View Download
Screen Shot 2016-10-14 at 13.47.47.png
82.6 KB View Download
Components: UI>Browser>Omnibox>PageInfo
Status: Fixed (was: Assigned)
Components: -UI>Browser>Omnibox>PageInfo UI>Browser>Bubbles>PageInfo
Components: -Security>UX

Sign in to add a comment