What we are working towards is the thing users had been assuming was true all along, that when they visit google.com that's google.com, else why would it say so? They are astonished to learn that Tim's toy hypermedia system didn't do that and we're only fixing it now in the 21st century.
Whereas you're talking about the sort of imaginary world where everybody begins a novel by perusing the copyright notice just inside the cover, to discern whether they are in fact permitted to read further.
Users aren't going to try to figure out what your "dedicated status bar" means, they'll be annoyed that they can't switch it off since it wastes space with things they don't care about and then they'll just stop seeing it, the way they don't really see those channel ID logos (DOGs) on a modern TV channel.
Your "prefetching" idea is not only terrible for privacy it also doesn't actually do what you probably expect it does, because web pages are too complicated and have been for decades, for this to be effective. In practice because there are so many HTTP transactions _only_ the checks the software can do automatically are worth anything, any time you start talking about how a user should be examining certificate details you're talking about an idea that can't actually work.
Not so much. I'm referring to a world where different weight and importance apply to different matter. There are things that are important and things that are really important (like your bank connection) and it is really the latter which matter.
> Users (…) e annoyed that they can't switch it off since it wastes space with things they don't care about (…)
With much the same anticipation we may expect users to hate the Start menu in Windows, since it occupies some space and they neither understand nor use it. Now guess, what happened. (Turns out, users are interested in knowing how to control their devices.)
Regarding prefetching, this was just escalating the idea. (In actuality, I'm not a friend of prefetching for any means. Don't waste bandwidth on a general level, just because you can't serve your assets in a time span that had been barely bearable with modems.)
But more importantly, user control is not at all the same thing as throwing a bunch of useless data at the user. Is it the site? Yes or no.
The start menu doesn't occupy space during normal use. (That's why I though you meant the start button.)
You were talking about getting rid of something that occupied space, but they didn't get rid of the start menu. In fact they made it bigger when activated.
And the changes they made had nothing to do with whether the user can control their device.
So I don't think any argument based on the windows 8 start menu is suitable for saying that an extra bar is a good idea.
Oh well, thanks for clarifying.
We gave all the information to users already, they didn't know what to do with it.
> Just establishing "any TLS" as the new normal doesn't especially help in a world, where you get a certificate for free with a new domain.
Establishing non-TLS as insecure is the end goal.
> possibly color coded. (Your bank must have a red certificate issued on its name, otherwise, run.) Prefetch certificates for links and display them side by side with the link target in said status bar, etc,...
Colors mean different things in cultures and have to be manually learned. Due to frequently broken TLS configurations and similar users will ignore the warnings as well. I really really don't think warnings help, either a fail-shut behavior is enforced (with annoying bypasses) or it might as well not exist.
As for colors or other signaling, yes, these are mostly cultural and are to be learned. (E.g., red isn't naturally "bad" or a warning, it may be rather "important") However, this is such a crucial technology, isn't it a viable option having a set of rules, which easily fits on a single page of legal paper in big print, and teach this to everyone? (How do people manage to cross the street, if they can't be expected to incorporate a simple set of rules? We, on the other hand, rather teach them to be careless and suspend judgement. Notably, I'm speaking of the desktop environment, mobile has a completely different set of requirements and widely proliferated alternatives, like dedicated apps for crucial tasks.)
And, regarding don't care about the identity as long as it is TLS, I'm not so sure.
Edit: E.g., have a dedicated status bar, displaying to whom the certificate was issued by what CA and what the security level (level of identification) is, possibly color coded. (Your bank must have a red certificate issued on its name, otherwise, run.) Prefetch certificates for links and display them side by side with the link target in said status bar, etc,...