1258527 - Add a pref to enable/disable degraded security UI for pages that went through a certificate override

Status: RESOLVED WONTFIX

(Firefox :: General, defect, P2)

Description

[Tanvi Vyas[:tanvi]]

In bug https://bugzilla.mozilla.org/show_bug.cgi?id=1201437, we stopped showing the green lock for pages that required a certificate override.  We changed it to a lock with a yellow triangle over it.

In bug https://bugzilla.mozilla.org/show_bug.cgi?id=1220753, we added a revoke certificate exception button to the control center.

In this bug, we should put bug 1201437 behind a pref.  The pref will determine whether we show the green lock or the grey lock + yellow triangle.  It should be set to true by default for now, where true means grey lock + yellow triangle.  The pref should not affect bug 1220753.  The revoke button should exist no matter what the pref is set to.

This should get uplifted to FF 47.  Thanks!

Comment 1

[Justin Dolske [:Dolske]]

Why a pref? Is it not ready to ship?

Comment 2

[Tanvi Vyas[:tanvi]]

(In reply to Justin Dolske [:Dolske] from comment #1)
> Why a pref? Is it not ready to ship?

We've had many reports of users who have to go through security exceptions for all HTTPS webpages (because they have a MITM proxy that is not properly configured).  We don't know what percentage of users this effects.  But we may need the ability to turn off this more alarming UI while we work out how to handle this set of users (who may never see the green lock again).  And hence, a pref would be nice to have just in case.

Note that the "MITM proxy" may be an antivirus software, and is not necessarily a bad actor (i.e. malware).

Mark, Steve - if you do decide that this is not necessary, we can mark this bug as closed-won't fix.  Just let us know.

Comment 3

[Panos Astithas (he/him) [:past] (please ni?)]

After some offline discussion with the platform security team and taking telemetry data into consideration we determined that this isn't necessary after all, since this segment of users has much more serious issues than warning fatigue.