Random Ramblings and personal observations on a wide variety of topics related to SSL & Security.
The opinions expressed in this blog and corresponding comments are my personal opinions – They do not represent the views of VeriSign, Inc.
Site Identification button:
Site Identification button replaces and builds upon the ubiquitous “padlock” icon that has for so long been the primary security indicator used in browsers. The button can be one of three colors — gray, blue, or green — and displays the new Site Identification dialog when clicked. The dialog includes a matching gray, blue, or green “Passport Officer” icon, and shows a summary of the information available about the site’s identity.
Here’s what the various colors mean:
Gray - No identity information
The gray Site Identification button indicates that the site doesn’t provide any identity information at all. Also, the connection between the browser and the server is either unencrypted or only partially encrypted, and should not be considered safe against possible eavesdroppers.
Blue - Basic identity information
The blue Site Identification button indicates that the site’s domain has been verified, and the connection between the browser and the server is encrypted and therefore protected against eavesdroppers.
When a domain has been verified, it means that the people who are running the site have bought a certificate proving that they own the domain and it is not being spoofed. It also assures me that the connection is encrypted so no one can eavesdrop on the connection and steal my bank login information that way.
What’s not verfied in this situation is who actually owns the domain in question.
Green - Complete identity information
The green Site Identification button indicates that the site provides fully verified identity information about its owner, and that the connection is encrypted.
If a site has a green Site Identification button it means that it is using a new “Extended Validation certificate” (EV). EV certificates are a special type of site validation certificate that requires a significantly more rigorous identity verification process than other types of certificate. So, while the blue Site Identification button indicates that a site’s domain is not being spoofed but does not have any verified information about who actually owns the domain, the green Site Identification button indicates that the domain is valid and that the owners of the domain are who you would expect them to be. With the EV certificate, the Site Identification button assures you that paypal.com is owned by Paypal Inc., for example. Not only does the Site Identification button go green on the Paypal site, it also expands and displays the name of the owner in the button itself.
two other colors:
Yellow - Invalid identity certificate
One thing you may encounter while surfing with Firefox 3 is a page that has a yellow Passport Officer icon. While the Site Identification button doesn’t have a “yellow” state, the Passport Officer icon will appear when there is some sort of problem with a site’s identity certificate.
Red - Reported attack site
There is also a stern red Passport Officer icon who carries a little stop sign rather than a passport. This is part of Firefox 3’s Malware and Phishing protection system that protects users against reported attack sites;
You can find more on this and other intresting Mozilla stuff by visitng Deb's blog: http://www.dria.org/wordpress
Comments [0]
Comments [0]