1301772 - Turn on Insecure Password Warning in Firefox Beta

Status: VERIFIED FIXED

(Firefox :: Security, defect, P1)

Description

[Tanvi Vyas[:tanvi]]

This bugs is to take the insecure password warning to Beta.  It requires a couple line code change here:
https://dxr.mozilla.org/mozilla-central/source/browser/app/profile/firefox.js?q=browser%2Fapp%2Fprofile%2Ffirefox.js&redirect_type=direct#1220

Comment 1

[Tanvi Vyas[:tanvi]]

It sounds like the best we can do here is get the first half of the beta release with:
#ifdef EARLY_BETA_OR_EARLIER

Comment 2

[Tanvi Vyas[:tanvi]]

If we want this to make Firefox Beta 50, we will have to land this next week and get uplift approval to aurora.

Alternatively, since this is just a pref change, we could go the hotfix route if the uplift doesn't get approved.

Comment 3

[Panos Astithas (he/him) [:past] (please ni?)]

Attachment: Bug 1301772 - Turn on Insecure Password Warning in Firefox Beta.

Review commit: https://reviewboard.mozilla.org/r/78126/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/78126/

Comment 4

[Florian Quèze [:florian]]

Comment on attachment 8790202 [details]
Bug 1301772 - Turn on Insecure Password Warning in Firefox Beta.

https://reviewboard.mozilla.org/r/78126/#review76606

::: browser/app/profile/firefox.js:1223
(Diff revision 1)
>  
>  // Block insecure active content on https pages
>  pref("security.mixed_content.block_active_content", true);
>  
>  // Show degraded UI for http pages with password fields.
>  // Only for Nightly and Dev Edition for not, not for beta or release.

Please update this comment to no longer say "not for beta".

Comment 5

[Panos Astithas (he/him) [:past] (please ni?)]

Good point, thanks. It's probably a pointless comment, but I've updated it to reflect reality.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/fx-team/rev/5d8afbdb3620
Turn on Insecure Password Warning in Firefox Beta. r=florian

Comment 7

[Tanvi Vyas[:tanvi]]

Panos, can you request uplift to aurora?  That way, the pref will be turned on for Firefox 50 Beta.

Comment 8

[Panos Astithas (he/him) [:past] (please ni?)]

Sure, I'm just waiting for the patch to land on m-c.

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/5d8afbdb3620

Comment 10

[Panos Astithas (he/him) [:past] (please ni?)]

Comment on attachment 8790202 [details]
Bug 1301772 - Turn on Insecure Password Warning in Firefox Beta.

Approval Request Comment
[Feature/regressing bug #]: feature from bug 1179961
[User impact if declined]: product and engineering want to get more feedback from early beta users, so we want to let this feature ride another train when 50 is merged to beta
[Describe test coverage new/current, TreeHerder]: there are automated tests for this in the tree
[Risks and why]: no risk, just a pref flip
[String/UUID change made/needed]: none

Comment 11

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8790202 [details]
Bug 1301772 - Turn on Insecure Password Warning in Firefox Beta.

Makes sense, Aurora50+

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/648df5f64606

Comment 13

[Paul Silaghi, QA [:pauly]]

I guess this can only be verified once 50 is merged to beta.

Comment 14

[Kohei Yoshino]

Updated the site compatibility doc: https://www.fxsitecompat.com/en-CA/docs/2015/non-https-sites-containing-login-form-will-be-marked-insecure/

Will tweet from @FxSiteCompat to get more attention from developers.

Comment 15

[Paul Silaghi, QA [:pauly]]

The lock with a strikethrough is displayed fine on the test pages:
http://people.mozilla.org/~tvyas/password/password_insecure.html
http://people.mozilla.org/~tvyas/password/frame_password.html
Verified fixed FX 50b1, 51.0a2 (2016-09-21) Win 7.

Comment 16

[Gervase Markham [:gerv]]

Is this going to ride the train to release, or is that a separate bug?

Gerv

Comment 17

[Panos Astithas (he/him) [:past] (please ni?)]

(In reply to Gervase Markham [:gerv] from comment #16)
> Is this going to ride the train to release, or is that a separate bug?

It is going to be a separate bug.