1067174 - Some SSL websites are considered untrusted when Firefox is started in a Windows child account

Status: RESOLVED DUPLICATE of bug 1189110

(Core :: Security, defect)

Description

[Kevin Brosnan [Ex-Mozilla]]

Visiting https://www.facebook.com , https://www.google.com or https://www.yahoo.com all result in a untrusted connection error if the user starts Firefox in a Windows child account.

STR:
* open the Windows user account manager
* create a new child account
* switch to the new child account that was just created
* Launch Firefox
* browses to the websites listed above

This is not true of all SSL websites one can load https://www.mozilla.org , https://www.microsoft.com , https://www.ebay.com

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

Not a recent regression tried a nightly from the Firefox 4 beta 3 timeframe and this issue still reproduced.

Comment 2

[Matthew N. [:MattN]]

This is outside the responsibilities of fx-team (Core).

Comment 3

[Liz Henry (:lizzard)]

Gian-Carlo, this bug came up today in the channel meeting and I want to make sure that your team is aware of it.   

Is there a way we can bring bugs to your attention or nominate them for escalation in some way similar to the process the firefox team uses?  (i.e. a particular flag or whiteboard tag) or is need-infoing a module owner or peer still the way to go? Thanks!

Comment 4

[Gian-Carlo Pascutto [:gcp]]

Redirecting to more appropriate people. This sounds like like a permissions issue with NSS on restricted accounts.

Comment 5

[Liz Henry (:lizzard)]

Matt, adding you in case you want to track this or if it relates to your certificate-related testing.

Comment 6

[Dana Keeler (she/her) [:keeler]]

Sorry it took a while to look into this. As far as I can tell, on Windows 8.1 child accounts, some connections are basically intercepted by the OS so they can be examined. Here's more information: http://support.microsoft.com/kb/2965142/en-us (including some documentation that indicates it's a known issue that this doesn't work seamlessly with Firefox). See also https://support.mozilla.org/en-US/questions/1006320

Comment 7

[Kevin Brosnan [Ex-Mozilla]]

I am very suspicious of this solution, http://support.microsoft.com/kb/2965142/ adds the Microsoft Family Safety Certificate to the CA list. This allows Microsoft to man in the middle the middle Firefox users.