1011638 - Pinning violations need a better UI

Status: RESOLVED DUPLICATE of bug 846489

(Core :: Security: PSM, defect)

Description

[[:mmc] Monica Chew (no longer reading bugmail)]

This may be required before pinning on stable, because the current UI gives no information or workarounds in case of captive portal. Compare the Chrome UI to the Firefox one.

Comment 1

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: firefox-pin-violation.png

Comment 2

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: chrome-pin-violation.jpg

Comment 4

[[:mmc] Monica Chew (no longer reading bugmail)]

The current proposal from Kathleen is to add a "More info" button to the page and have it open a SUMO page. This will minimize FE changes. Madhava, what do you think?

The context is that we are introducing a new SSL failure mode that is most likely transient, so we want to notify users what is causing the problem and have them try again later.

Comment 5

[Kathleen Wilson]

Or add a third bullet point: "- More information" which links to a SUMO page.

Whatever is the simplest change to the UI that would allow us to provide further information in SUMO pages.

Comment 6

[[:mmc] Monica Chew (no longer reading bugmail)]

Attachment: Screen Shot 2014-05-21 at 1.31.12 PM.png

The Mac error page is slightly less eye-searing than the Linux one. To reproduce, download Nightly past 5/21, set security.cert_pinning.enforcement_level = 3 in about:config (enforces test pins), and visit https://pinningtest.appspot.com/

Comment 7

[Dana Keeler (she/her) (use needinfo) (:keeler for reviews)]

I think this was addressed in bug 846489 (and other bugs) - there's now a "Learn more" link (which goes to a sumo article that doesn't have pinning-specific information on it, but we can always change that). Also, captive portal detection is happening now, so I think we're good here.