102269 - Cookie Manager: "Server Secure" is unclear

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect)

Description

[André Dahlqvist]

In the Cookie Manager, on the Stored Cookies tab, there is a label called
"Server Secure:____". I really think that should be replaced by "Secure Server:
____". Below I will attach a patch that does that.

Comment 1

[André Dahlqvist]

Attachment: Patch that replaces "Server Secure:" with "Secure Server:" in both the Cookie Manager and in the help file.

Comment 2

[sairuh (rarely reading bugmail)]

to cookies.

Comment 3

[Stephen P. Morse]

We are going round in circles here.  Take a look at bug 51145.

I'm not sure I agree with this patch.  "Secure Server" sounds like "secure" is a 
verb (rather than an adjective) and you are going to "secure the server".

Frankly I'm not happy with either "secure server" or server secure" since 
neither reflect what is happening.  The meaning of this field is that if it is 
"true", then the cookie will not be sent back to a server that doesn't use 
https.  So a correct label would be "send cookie to a secure server only".  But 
abreviating it to either "secure server" or "server secure" doesn't capture that 
meaning at all.

Therefore I'm marking the target milestone as "future" which is my way of saying 
that it won't get fixed.  If someone can come up with a descriptive word or two 
that can better describe this field, then please post it here and I'll 
reconsider the target milestone.  Maybe just "secure" would do but I'm sure that 
we had that at one time and it got changed.

cc'ing german on this for the usual reason.

Comment 4

[Stephen P. Morse]

Same wording occurs on all platforms.  Changing platform from linux to all.

Comment 5

[André Dahlqvist]

Morse, we are going around in circles because you change this wording between
version 1.8 and 1.9 without describing why. In bug 51145 Henrik Gemal asked for
the wording to be changed from "Secure Server?" to "Secure Server:". But when
this was checked in it ended up as the horrible "Server Secure".

Comment 6

[Stephen P. Morse]

Oops, you are correct about that.

In any case, I find either wording to be meaningless for the reasons I gave 
above.  Can you suggest something that describes what is really going on?

Comment 7

[André Dahlqvist]

How about "Send Securely"?

Comment 8

[Stephen P. Morse]

That would imply that there is something that we would do to the cookie at send 
time to make it secure (such as encrypting it).  It does not convey the concept 
that we won't send it if the site can't receive it securely.

Comment 9

[timeless]

we haven't sparred over this in over a month.

Comment 10

[Gervase Markham [:gerv]]

timeless: did you CC us for ideas?

How about "Keep Secret:"?

"Keep Secret: yes" means that we won't do anything to compromise the secrecy of
the cookie. "no" means we don't care.

"Keep Secure" or "Keep Private" might be other options.

Gerv

Comment 11

[robinf]

cc:ing Sean, who's the writer for this area. He's on sabbatical until early
December, so I'll jump in. I like Gerv's suggestion "Keep Secure", or "Secure
Connection".

Comment 12

[Junk_HbJ]

Attachment: New patch for helpfile and cookie manager with "Keep Secure"

Comment 13

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win95; en-US; rv:1.3) Gecko/20030312]

Some ideas to revive the discussion on this bug:
 (They are all keywords: feel free to mix between them !)
*HttpS (sites) only
*SSL (servers) needed
*Secure (connections) checked

Unlike comment 11,
I don't like "Keep xxx" because it could be related to the storage on the user
computer,
Nor "Secure connection" because (as written in comment 3) it looks like a verb
("Keep xxx" too !).

Comment 14

[Serge Gautherie (:sgautherie)]

Severity should be changed from 'Normal' to 'Trivial' !?

Comment 15

[timeless]

.

Comment 16

[[e-mail]]

hmm, adding myself to cc since bugzilla apparently doesn't fwd me bugmail on 
this one, even though it's assigned to me...

I also like Gerv's suggestion, "Keep Secure".

-> mvl since he's the "cookie UI guy" :)

Comment 17

[Erwan Legrand]

"HTTPS only" is short enough and describes this flag quite well, I think. I also
agree that "Keep Secure" could mean lots of things like encrypting on storage
media and such.

Comment 18

[benc]

The meaning of this field in cookies is too complicated to convey accurately in
a tag line (I'd use "secure-only" if I had to).

What we need to do is find a way of getting the full explaination to the user
easily.

Comment 19

[benc]

I've been working on some test cases in this area, after thinking about this
some more, and finding that "secure" cookies can only be sent to an HTTPS
server, I like #17.

Comment 20

[Urban A. Haas]

How about "Require HTTPS:". It should Translate well into other languages as well.

Comment 21

[Mike Connor [:mconnor]]

"Does your grandmother know what HTTPS Only means?"

I don't know if any of the alternatives are any better.  How many users 
understand this flag, let alone care?  And would a different string really make 
any usability difference?  Most people would still need to look at the Help 
file to understand this.   Keep Secure is probably the best of the bunch, IMO.

Comment 22

[Daniel Wang]

Attachment: patch. alternative approach using tooltip

Comment 23

[[e-mail]]

Comment on attachment 143010 [details] [diff] [review]
patch. alternative approach using tooltip

timeless, please do review this if you so desire, but i think mconnor should
look at this too

Comment 24

[Mike Connor [:mconnor]]

Comment on attachment 143010 [details] [diff] [review]
patch. alternative approach using tooltip

Adding a tooltip would be quite inconsistent with pretty much the rest of the
Navigator UI (excluding toolbars, obviously).  Being inconsistent for something
as obscure as this flag is a bad idea.	If someone is curious, the Help file
does have an excellent description of what this does.

I'm almost in agreement of Morse's original assessment that there really isn't
a good fix for this.  HTTPS Only actually is the closest to what it does, but
is that any more clear?

I'm almost thinking we should just mark this WONTFIX and move on to more
important things.

Comment 25

[Daniel Wang]

-> wontfix

Comment 26

[Gervase Markham [:gerv]]

I'm sorry, I don't agree. Just because it can't be perfect doesn't mean it can't
be better. If we want to move on, let's switch to "Keep Secure" using attachment
87806 [review], as several people seem to think that's an improvement.

Gerv

Comment 27

[Gervase Markham [:gerv]]

Comment on attachment 87806 [details] [diff] [review]
New patch for helpfile and cookie manager with "Keep Secure"

r=gerv. Who's the module owner associated with Cookies these days?

Gerv

Comment 28

[[e-mail]]

darin's the MO, i'm a peer. mconnor's the UI guy, so i think any patch that
touches cookiemgr should have his blessing.

mconnor, what do you think of the patch gerv r+'ed?

Comment 29

[Mike Connor [:mconnor]]

the problem with "Keep Secure" that became apparent to me later is that it
implies that we're keeping it in some sort of secure storage.  If we're going to
change for the sake of changing it, I think HTTPS Only would be the better choice.

Comment 30

[Mike Connor [:mconnor]]

Comment on attachment 87806 [details] [diff] [review]
New patch for helpfile and cookie manager with "Keep Secure"

This really would be misleading/confusing.  We don't keep these cookies in any
sort of secure format.

Better solution forthcoming.

Comment 31

[Mike Connor [:mconnor]]

Attachment: patch

Instead of 
Server Secure: yes || Server Secure: no
Use
Send For: Encrypted connections only || Send For: Any type of connection

Comment 32

[Mike Connor [:mconnor]]

Attachment: patch v2 including dialog update

Comment 33

[Michiel van Leeuwen (email: mvl+moz@)]

Comment on attachment 143120 [details] [diff] [review]
patch v2 including dialog update

>Index: mozilla/extensions/cookie/resources/content/cookieAcceptDialog.js
>         document.getElementById('ifl_isSecure').setAttribute("value",
>                                                                  cookie.isSecure ?
>-                                                                    cookieBundle.getString("yes") : cookieBundle.getString("no")
>+                                                                    cookieBundle.getString("forSecureOnly") : cookieBundle.getString("forAnyConnection")

This line is getting pretty long...

Anyway, i think this improves the wording, so lets go for it. r=mvl

Comment 34

[Mike Connor [:mconnor]]

Comment on attachment 143120 [details] [diff] [review]
patch v2 including dialog update

alec, this one is pretty trivial if you have time before freeze...

Comment 35

[Alec Flett]

Comment on attachment 143120 [details] [diff] [review]
patch v2 including dialog update

sr=alecf

Comment 36

[Mike Connor [:mconnor]]

updating bug summary since Secure Server was rejected around 2002

checked in 03/07/2004 00:25

Comment 37

[benc]

V/fixed: Mac OS X, Mozilla 1.7rc2.

Comment 38

[benc]

V/fixed: mozilla 1.7.2/Win XP