Steve England [:stevee] Reporter
	Description • 17 years ago

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a8pre) Gecko/2007090614 Minefield/3.0a8pre ID:2007090614

For instance, I was confused why having Identity Verified was better than having Location Verified. (EV > SSL). And I am also confused as to why we use Identity Unknown rather than Location Unknown for a site with no credentials.

I've been using the web a fairly long time, but I never really understood SSL. I always thought the main reason for it was to have an encrypted link between me and the website I was using, but I have since been educated that it's more to do with ensuring the site you visited is the site you ended up on (which, i guess, is why Larry tells me "Location Verified" and then mentions the encryption almost as an afterthought).

So as a self-centered benchmark, if this confuses me, I'm not sure how useful it will be to Joe Q Public. Unfortunately I can't think of any way to make this clearer without making it more wordy.

My initial thoughts are to have two lines describing the site instead of one:
- Location: Verified / Not Verified
- Identity: Verified / Not Verified

For for a normal site, you'd just use Location: Not Verified (maybe also Identity: Not Verified)
For SSL, Location:Verified, Identity:Not Verified
and for EV, Location:Verified, Identity:Verified.

Maybe we should use more words to help people more:
- Location: Verified (We have verified this web address as the one you intended to visit (you have not been secretly redirected to a suspicious web address))
- Location: Unverified (We are unable to guarantee that the web address you wanted to visit is the one you have arrived at. (This is not normally a problem unless you are conducting a business transaction with this web address))

- Identity: Verified (We have verified that this website is owned and run by <company>, <address>, <etc>)
- Identity: Unverified (We are unable to verify the company who runs this web address)

But also, 'Location' doesn't feel like something I can relate to in the web-o-sphere. So maybe instead of Location, perhaps we should use Web Server, or Web Address, or something? Maybe instead of Identity we should use Owner or Company or something?

	Ian Pottinger
	Comment 1 • 17 years ago

What does "Location Verified" or "Web Address Verified" mean?  Is this a spell check of the URL bar?

If encrypting a connection is about privacy then make it clear:

- PRIVATE CONNECTION
- Your connection to this site is encrypted to prevent eavesdropping

Else, if encryption is more about ensuring the other end of the connection is what you want it to be then make that clear:

- CONNECTION VERIFIED
- Your connection is encrypted to ensure it is and remains
- a connection to the site you requested."

In either case, make it clear that the message is about the nature of the connection, and not about what was typed into the URL bar.

	Johnathan Nightingale [:johnath]
	Comment 2 • 17 years ago

Picking up on some of stevee's thoughts, bug 406612 restyled the identity panel and text.  Marking this bug fixed as a result of that one.