[tbb-bugs] #21321 [Applications/Tor Browser]: .onion HTTP is shown as non-secure in Tor Browser

Tor Bug Tracker & Wiki blackhole at torproject.org
Fri Jun 30 15:45:09 UTC 2017

#21321: .onion HTTP is shown as non-secure in Tor Browser
 Reporter:  cypherpunks                          |          Owner:  tbb-
                                                 |  team
     Type:  task                                 |         Status:  new
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Blocker                              |     Resolution:
 Keywords:  ff52-esr, tbb-usability, ux-team,    |  Actual Points:
  TorBrowserTeam201706                           |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:

Comment (by linda):

 Hi, the UX team has reviewed this ticket, and we recommend removing the
 warnings as soon as possible and working on messaging thereafter.

 I think that there are two problems to solve, 1) the password and padlock
 warnings are misleading users, telling them that something is secure when
 it isn't 2) educating users on what secure means. I think that we can, and
 should, solve these issues independently. Getting rid of the warnings will
 be a much better improvement than leaving them up, even if there is no

 Of course, it would be good to educate users on why .onion sites are
 secure. When we onboard users to Tor, we should mention .onion sites and
 other features on first use, and show information on .onion sites when
 they first visit an onion website. Additionally, we can also put a message
 when you click on or hover over the "secure" indicator (something like
 [https://share.riseup.net/#fi-f_QKZqY8pV8Kf0BXR9g this]) that says why
 .onion sites are safe, for people who are wondering why it is safe.

 I, Linda, especially agree with mrphs'  comment, who suggested:

 Replying to [comment:19 mrphs]:

 > 1- Remove the password warning. (this is immediate)
 > 2- Remove the padlock warning. (also immediate, preferably at the same
 time with 1)
 > 3- Improve our messaging with user about .onion URLs in Tor Browser to
 make sure we're consistent (more long-term but prevents us from situations
 like this)

 We're essentially recommending the same thing, with an emphasis on
 separating out 1+2 from 3.

 > I guess the reason I'm leaving this comment is that we don't get into a
 rabbit hole that gets us away from fixing this immediate need.

 +1, we should fix this issue, and solve on working on user understanding
 later. Ultimately, the warnings are more confusing and interrupting user

Ticket URL: <https://trac.torproject.org/projects/tor/ticket/21321#comment:34>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

More information about the tbb-bugs mailing list