We will make the shield icon persistent on the URL bar and removing the "i" icon. The new protections panel will be anchored on the persistent shield icon and the identity panel will be anchored on the lock icon.

The patch moves the tracking protection icon out of the identity block,
and making it persistent.

Depends on D37787

We hide the identity icon if there is a lock icon there. If not, the
identity icon will still be shown.

Depends on D37788

Depends on D37789

This patch changes the anchor point of the identity popup to the lock
icon from the identity icon. And move the anchor point of the
protections popup to the shield icon container. Also remove the alt key
which is needed to open the protection icon.

In addtion, this also makes these two popups are mutual exclusive.

Depends on D37790

Depends on D37791

Just a small question here:
Isn't lock style on HTTP page (as screenshot on comment 8 ) a bit confusing with the one on mix content page?

(In reply to lolipopplus from comment #9)

Just a small question here:
Isn't lock style on HTTP page (as screenshot on comment 8 ) a bit confusing with the one on mix content page?

You're confusing that icon with this one: https://design.firefox.com/icons/viewer/#secure%20mixed
The broken padlock is used for HTTP and broken HTTPS (mixed active content, cert errors etc) but the one with yellow warning icon is used for mixed passive content (images and other media).

https://hg.mozilla.org/mozilla-central/rev/eb7359a95a75
https://hg.mozilla.org/mozilla-central/rev/8e1a9e517cfd
https://hg.mozilla.org/mozilla-central/rev/c727ba3536a2
https://hg.mozilla.org/mozilla-central/rev/1228703fef68
https://hg.mozilla.org/mozilla-central/rev/f457b7f300cf
https://hg.mozilla.org/mozilla-central/rev/c5ba93a2d508

Should localhost really be insecure? (See Twitter)

Also will this land in Firefox for Android/Firefox preview?

IMHO, Newbies shouldn't get used to develop applications without built-in TLS: https://github.com/FiloSottile/mkcert
http:// is deprecated, almost like ftp://. gopher:// is already gone.

I'm not sure which Tweet you mean. I've found this recent one: https://twitter.com/spedru/status/1152066665548378112
It's the result of manually changing browser.urlbar.trimURLs to false and security.insecure_connection_text.enabled to true.
I think, at least showing http:// would be a better default as you only need to click into the address bar, add an s (for https://) and press enter.
Today you need to click and then type the whole https:// to try the secure variant of a website - a counterproductive obstacle.
But at the end, http:// should look noticeably ugly while https:// should be hidden and tidy and switching over to it should be a bit easier than today.

I'm not sure which Tweet you mean. I've found this recent one: https://twitter.com/spedru/status/1152066665548378112

Did not mean that one but it had similar content

http:// is deprecated

Local development tools, app (e.g. OAuth) and similar things sill use http on localhost and will probably use it in the next years. I've nothing without https in the public, but my development is still http.
Also this is the only thing to be consistent with the standards, all the secure context apis (like ServiceWorker) only work with https and localhost.

Today you need to click and then type the whole https:// to try the secure variant of a website - a counterproductive obstacle.
But at the end, http:// should look noticeably ugly while https:// should be hidden and tidy and switching over to it should be a bit easier than today.

I'm for integrating something like HTTPS Everywhere's "try encrypted or big red warning" by default into Firefox anyway

Posted site compatibility note: https://www.fxsitecompat.dev/en-CA/docs/2019/firefox-location-bar-now-shows-broken-padlock-icon-for-insecure-sites/

¡Hola!

FWIW just wanted to point out that the (i) icon is still visible in the about:about page.

¡Gracias!
Alex

(In reply to alex_mayorga from comment #18)

¡Hola!

FWIW just wanted to point out that the (i) icon is still visible in the about:about page.

¡Gracias!
Alex

See bug 1567443.

I have reproduced this bug with Nightly 69.0a1 (2019-07-02)on windows 10, 64 bit!

The fix is now verified on Latest Beta 70.0b9.

Build ID: 20190923154733
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0

Adding to release notes as "A new crossed-out lock icon now indicates insecure HTTP"