1057035 - The text in the certificate exception dialog for a domain mismatch uses the wrong terminology

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

When adding a certificate override for a domain mismatch, the text currently reads:

"Certificate belongs to a different site, which could indicate an identity theft."

"Identity theft" has a different meaning than what could be happening in these cases (i.e. that someone is attempting to impersonate a site).

Comment 1

[:Cykesiopka]

Attachment: bug1057035_v1.patch

This patch uses the terminology from certerror.whatShouldIDo.content.

(addExceptionExpiredLong "[...] It is impossible to verify whether this identity was reported as stolen or lost." also looks like it should be changed, but I'm not sure about this.)

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8511634 [details] [diff] [review]
bug1057035_v1.patch

Review of attachment 8511634 [details] [diff] [review]:
-----------------------------------------------------------------

Yeah, most of these other descriptions are fairly unclear as well. Anyway, looks good to me. I suggested a few other updates. This should probably also get sign-off from someone from UX before it lands (e.g. :phlsa).

::: security/manager/locales/en-US/chrome/pippki/pippki.properties
@@ +152,5 @@
>  #Add Security Exception dialog
>  addExceptionBrandedWarning2=You are about to override how %S identifies this site.
>  addExceptionInvalidHeader=This site attempts to identify itself with invalid information.
>  addExceptionDomainMismatchShort=Wrong Site
> +addExceptionDomainMismatchLong2=Certificate belongs to a different site, which could mean that someone is trying to impersonate the site.

nit: I would say "The certificate..." and "... impersonate this site". (I think all of these should start with "The certificate..." instead of "Certificate...")

@@ +157,2 @@
>  addExceptionExpiredShort=Outdated Information
>  addExceptionExpiredLong=Certificate is not currently valid. It is impossible to verify whether this identity was reported as stolen or lost.

Maybe something like this: "The certificate is not currently valid. It may have been stolen or lost, and could be used by someone to impersonate this site."

@@ +157,4 @@
>  addExceptionExpiredShort=Outdated Information
>  addExceptionExpiredLong=Certificate is not currently valid. It is impossible to verify whether this identity was reported as stolen or lost.
>  addExceptionUnverifiedOrBadSignatureShort=Unknown Identity
>  addExceptionUnverifiedOrBadSignatureLong=Certificate is not trusted, because it hasn't been verified by a recognized authority using a secure signature.

This should probably be "The certificate is not trusted because it hasn't been verified as issued by a trusted authority using a secure signature."

Comment 3

[:Cykesiopka]

Attachment: bug1057035_v2.patch

+ Makes the suggested changes from Comment 2
+ Standardise strings that mention "site" with the phrase "this site" for consistency

Comment 4

[:Cykesiopka]

Comment on attachment 8512418 [details] [diff] [review]
bug1057035_v2.patch

Hi Philipp,

Could you give the new wording a review?

Thanks.

Comment 5

[(Currently slow to respond) Philipp Sackl [:phlsa] (Firefox UX) please use needinfo]

It would be great to see the old and the new version in context.
Could you provide screen shots? Thanks!

Comment 6

[:Cykesiopka]

(In reply to Philipp Sackl [:phlsa] from comment #5)
> It would be great to see the old and the new version in context.
> Could you provide screen shots? Thanks!

Sure.

Comment 7

[:Cykesiopka]

Attachment: bug1057035_oldWording.png

This is the cert exception dialogue showing the relevant old versions of the error texts.

Comment 8

[:Cykesiopka]

Attachment: bug1057035_newWording.png

This is the cert exception dialogue showing the relevant new versions of the error texts.

Comment 9

[(Currently slow to respond) Philipp Sackl [:phlsa] (Firefox UX) please use needinfo]

Comment on attachment 8512418 [details] [diff] [review]
bug1057035_v2.patch

Thanks for the screenshots!
The new wording is definitely better.

There's a different issue in there (which is likely material for a new bug) in that it is quite hard to decipher which headline belongs to which paragraph (in the leftmost screenshot). But that has nothing to do with the strings, just with the way the text is laid out.

Comment 10

[:Cykesiopka]

Thanks for the reviews!

https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=707eecbcb322

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/20c03bdfdc70

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/20c03bdfdc70