909326 - [UX] Overhaul the site identity and connection information in the identity panel

Status: RESOLVED DUPLICATE of bug 1125402

(Firefox :: Security, defect)

Description

[Dão Gottwald [:dao]]

attachment 765397 [details] contains some mockups for this. Is this final? Has it been discussed with security folks?

Comment 1

[Larissa Co [:lco]]

I think we need to show examples of what the site identity permissions look like for all the potential cases, such as when there's Mixed Content on the page, etc. Boriss, I can help you hash out these cases with whoever on the security team is interested in laying them out with us :)

Comment 2

[Dão Gottwald [:dao]]

Note that this bug is specifically about the site identity and connection security part of the popup.

Comment 3

[Dão Gottwald [:dao]]

This needs final mockups or clarification that the existing mockup is good to go.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Larissa is right - the mockups need to show more cases. Also, the text for the non-encrypted case shouldn't say the connection is encrypted to prevent eavesdropping.

Here are the cases I can think of off the top of my head:
- no encryption
- domain validation certificate
- domain validation certificate with mixed content
- extended validation certificate (green)
- extended validation certificate with mixed content (I think this would fall back to look like dv with mixed content, but I'm not sure)
- bad certificate that has been overridden by the user (e.g. domain mismatch, expired certificate, etc.)
- bad certificate with override with mixed content

Comment 5

[Florian Bender]

What about Opportunistic Encryption in HTTP/2? This is a bit down the road and can be deferred, and I'm not even sure if this needs or should have a distinct status at all, but it should be taken into consideration.

I don't know who can give input on this … :hurley, :mcmanus, you did the implementation of HTTP/2 – is there something different about it that may require a separate indication?

Comment 6

[u408661]

Unauthenticated TLS (let's not call it opportunistic encryption, since that could, in fact, include fully-authenticated TLS as we know it) likely should not (IMHO) have any UI different from what we do for plain, non-encrypted http. It's not something the user should have to know about, and we don't want to confuse the security situation any further.

Not to mention the fact that it's in no way guaranteed that unauthenticated TLS will become part of HTTP/2 to begin with :)

Comment 7

[Jesse Ruderman]

If the connection ends up fully authenticated, I hope it involves a "redirect" to https (without the round-trip usually implied by the term), so bookmarking and sharing give the secure page.

Comment 8

[Patrick McManus [:mcmanus]]

(In reply to Jesse Ruderman from comment #7)
> If the connection ends up fully authenticated, I hope it involves a
> "redirect" to https (without the round-trip usually implied by the term), so
> bookmarking and sharing give the secure page.

approaches to doing http:// over TLS do not change the scheme to https:// ; it is merely a routing change for transport over a better link. http/2 carries the scheme explicitly with each request, so this is unambigous to the server. The server may explicitly want to stay on http:// for reasons of mixed-content or even SNI load balancing concerns (depending on how this was bootstrapped).

if it were authenticated we might be able to honor key pins or even STS. That's not fleshed out yet and would probably be added incrementally.

Comment 9

[Jennifer Morrow [:Boriss] (UX)]

Attachment: Mockup: Site identity redesign

Attached design is ready for implementation, aside from needing to get that icon.  I'll file a followup and look for an icon (we may have one that works already).

Comment 10

[Florian Bender]

Comment on attachment 8444120 [details]
Mockup: Site identity redesign

YES please use the sloth somewhere! E.g. for high profile sites that don't use TLS or something ;)

Anyhow, how is the identity information for EV certificates supposed to be displayed? E.g. in Bugzilla, the identity panel currently displays the owner (MoFo) and its location (MV, CA, US[1]) as well as the signee (DigiCert). Also, non-EV certs are presented with a blue-ish base color to indicate a non-optimal security level (the optimal security level being "green"); the design seems to propose the "green" level for non-EV certificates – is that intentional?

I'd propose to use the (awesome!) design by :Boriss and merge it with the current way of displaying EV-certs (with additional identity + signee info) using the green check icon, and use the design in the attachment for non-EV-certs but with a blue icon (preferably the sloth![2] or the check icon) and all-black text. 

Can someone of the sec team review this, please?


[1] I wonder why "US" is used instead of "USA" – that seems wrong …
[2] I know I know, the sloth may confuse some. But can we at least have it as the identity icon for non-EV certs or unsigned domains in Nightly, please? :D

Comment 11

[Dão Gottwald [:dao]]

(In reply to Florian Bender from comment #10)
> Can someone of the sec team review this, please?

Right, see my question in comment 0. Without that this isn't ready for implementation.

(In reply to Larissa Co [:lco] from comment #1)
> I think we need to show examples of what the site identity permissions look
> like for all the potential cases, such as when there's Mixed Content on the
> page, etc. Boriss, I can help you hash out these cases with whoever on the
> security team is interested in laying them out with us :)

The new mockup still doesn't seem comprehensive enough.

Comment 12

[u428464]

The mockup also misses all the visual part (ie. icons and Australis panel styling)

Comment 13

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

A couple of other cases that should be covered:
- mixed content
- a domain validation site (as opposed to an extended validation site, as (presumably) shown. On that topic - do we want to include the organization field for extended validation? (for example, on bugzilla the organization is "Mozilla Foundation")).

Comment 14

[Florian Bender]

Any chance this may get picked up again?

Comment 15

[Tim Taubert [:ttaubert] (inactive)]

Bug 1125402 and friends will rework the identity panel, feedback appreciated. Should we dupe this?