85092 - "site ... does not support encryption" is misleading (page info->security)

Status: VERIFIED INVALID

(Core Graveyard :: Security: UI, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
1. Go to http://paydirect.yahoo.com/.
2. Open Page Info (Ctrl+I) and select the Security tab.

Notice the text "The web site paydirect.yahoo.com does not support encryption 
for the page you are viewing."  But if I go to https://paydirect.yahoo.com/, I 
get the same page, encrypted, so the server does support encryption for that 
page.

Unless someone

Comment 1

[Jesse Ruderman]

Unless someone knows what that line of text was supposed to mean, it's probably 
best to just remove the line.

Comment 2

[John Unruh]

Marking invalid. The behavior is as expected. The http server is using the 
default port 80, and the https server is using the default ssl port of 443. So, 
you are actually reaching the same page, but sent by two different servers. So, 
http://paydirect.yahoo.com:80 actually does not support encryption.

Comment 3

[John Unruh]

Verified invalid.

Comment 4

[Jesse Ruderman]

I still think it's misleading.  Many people think of http://www.ecount.com/ and
https://www.ecount.com/ as being the same server, and think of "www.ecount.com"
as the server for each of those URLs.

Comment 5

[John Unruh]

Mass changing Security:Crypto to PSM

Comment 6

[John Unruh]

Mass changing Security:Crypto to PSM