1328708 - Github login is considered insecure, even though it uses HTTPS

Status: RESOLVED WORKSFORME

(Firefox :: Untriaged, defect)

Description

[clogged.drainpipe]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0
Build ID: 20170104030214

Steps to reproduce:

Try to log in to Github (https://github.com/login)


Actual results:

Got an insecure password field warning.


Expected results:

No warning, the page uses HTTPS.

Comment 1

[Tanvi Vyas[:tanvi]]

I wasn't able to reproduce this.  Kamil, can you use the latest Nightly and see if you see this issue?

Thanks!

Comment 2

[Matthew N. [:MattN]]

Can you please include steps to reproduce which include the site that sent you to GitHub? The GitHub login page could have had a non-secure opener browsing context[1] e.g. an HTTP page used window.open to open https://github.com/login.

[1] https://w3c.github.io/webappsec-secure-contexts/#examples-top-level

Comment 3

[clogged.drainpipe]

It seems to be working fine right, now. Before I could easily reproduce, but now I cannot.
Maybe Github was temporarily doing something funky with their infrastructure?

Closing bug.

Comment 4

[Kamil Jozwiak [:kjozwiak]]

Removing the ni?. I tried reproducing the issue with several different websites but couldn't reproduce either. Looking at comment#3, it seems like this isn't happening anymore.