1342476 - The insecure password support page can't be accessed using only the keyboard

Status: NEW

(Firefox :: Security, defect, P5)

Description

[Iulia Cristescu, QA [:JuliaC] (away, please needinfo? [e-mail])]

[Affected versions]:
- latest Nightly 54.0a1 (2017-02-24)
- latest Aurora 53.0a2 (2017-02-24)
- 52.0b9 build2 (20170223185858)

[Affected platforms]:
- Windows 10 x64	
- Windows 7 x64	
- Ubuntu 16.04 x64	
- Mac OS 10.11.6	

[Steps to reproduce]:
1. Launch Firefox
2. Go to a http site that requires a login process (e.g. http://imgur.com/login) 
3. Focus the username / email field (if it is not already autofocused)
4. Use the keyboard (up/down arrow) in order to focus the insecure contextual warning
5. Use the keyboard (hit Enter) in order to access the insecure password support page 
6. Repeat steps 3, 4 and 5 for the password field

[Expected result]:
- [step 5] [step6] A new tab is opened and the user is redirected to Mozilla Support: https://support.mozilla.org/en-US/kb/insecure-password-warning-firefox?as=u&utm_source=inproduct

[Actual result]:
- The insecure contextual warning is dismissed
- The insecure password support page is not opened 

[Regression range]:
- I will investigate this as soon as possible

[Additional notes]:
- The issue is not e10s related

Comment 1

[YF (Yang)]

I guess it is not a regression, but because of the introduction of the feature.

Comment 2

[Iulia Cristescu, QA [:JuliaC] (away, please needinfo? [e-mail])]

Yes, indeed, this is not a regression, as is reproducible starting with 53.0a1 (20170104030214), when bug 1217152 was fixed.

Comment 3

[Peter Dolanjski [:pdol]]

Ryan, what's your input on this?  How important is this to fix?
It may be an accessibility issue, but actually clicking the learn more link would likely only be useful once.
Also, it may conflict with users' flows whereby they have muscle memory (hitting Enter would open a new tab).

It mostly stems from having a Learn More link in the autocomplete row.

Comment 4

[Ryan Feeley [:rfeeley]]

I believe that MattN had some reasons for not including. I'm worried that it will be triggered accidentally more often than not, which is distracting as it opens a web page.

The original plan was to open control center to connection subview, less harmful (and what Chrome is doing).

Matt, can you clarify what the current status is?

Comment 5

[Julien Cristau [:jcristau]]

Mass wontfix for bugs affecting firefox 52.

Comment 6

[Matthew N. [:MattN]]

It is complicated to implement this because of the two separate processes. I believe we found an approach for form autofill's footer that works okay so we can use that same approach for this warning.