1605831 - SSL Certificates: Don't automatically check checkbox to send URLs to Mozilla if "Send Technical & Interaction Data to Mozilla" setting is disabled

Status: RESOLVED WONTFIX

(Firefox :: Security, enhancement, P3)

Description

[elliottabarnes]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0

Steps to reproduce:

To reproduce:

1. From within the Options dialog, navigate to the "Privacy & Security" panel and ensure that the "Send Technical & Interaction Data to Mozilla" checkbox is unchecked

2. Navigate to any URL prefixed with "https://" - ensuring that the SSL certificate for this URL is recognised as expired, or not valid for that particular domain

When Firefox displays the warning about this certificate, you'll noticed that despite unchecking the checkbox to send data to Mozilla in the previous steps, the checkbox to notify Mozilla about this URL is checked by default. Considering that only advanced or privacy-minded users are likely to uncheck this box, could we consider unchecking the box by default to send these URL lists to Mozilla when encountering an invalid cert?

Actual results:

N/A

Expected results:

N/A

Comment 1

[Florencia Di Ciocco, NI to vbalducci]

Hi Elliott,

Could you please provide me with any URL prefixed with "https://" - ensuring that the SSL certificate for this URL is recognised as expired?

Thanks in advance, Flor.

Comment 2

[elliottabarnes]

Unfortunately I don't have any example URLs to hand - apologies for this. Will keep looking to see if I can find one!

Comment 3

[Florencia Di Ciocco, NI to vbalducci]

Hi Elliot,

Did you find anything?

Comment 4

[elliottabarnes]

Unfortunately not. This is triggered for any invalid cert, however - the only examples I have to hand are within internal corporate environments. The easiest way of triggering this may be to set up a test server, generate an SSL cert but only set it to be valid for a domain that doesn't apply in the test situation.

Comment 5

[Florencia Di Ciocco, NI to vbalducci]

No prob, I've chosen a component for this bug in hope that someone with more expertise may look at it. We'll await for their answer. If you consider that there's another component that's more proper for this case you may change it.

Comment 6

[Johann Hofmann [:johannh]]

Seems like a good idea.

Comment 7

[aarushivij]

Hello,
Is this issue a UI related issue, where checkbox is checked by default, though it actually donot send urls to mozilla, due to the previous setting.
Or even if "Send technical and interaction data to mozilla" is disabled, it, the checkbox is checked and it do send data?
Also any url to reproduce the issue?
Thanks
Aarushi

Comment 8

[:ingrid]

I would like to be assigned, thank you!

Comment 9

[:prathiksha]

(In reply to :ingrid from comment #8)

I would like to be assigned, thank you!

Steps to reproduce -

1. Go to 'about:config' and set "security.ssl.errorReporting.enabled" and "security.ssl.errorReporting.automatic" to true
2. Go to 'about:preferences' -> Privacy & Security and deselect the "Send Technical & Interaction Data to Mozilla" checkbox
3. Open a page like https://expired.badssl.com/

Actual results : The error reporting checkbox on https://expired.badssl.com/ is selected

Expected Results : The check box on https://expired.badssl.com/ should be deselected or hidden

Ingrid, please feel free to get in touch on Matrix if you have any questions.

Comment 10

[:ingrid]

Attachment: Bug 1605831 - SSL Certificates: Don't automatically check checkbox to send URLs to Mozilla if Send

Comment 11

[:ingrid]

Ups, something went wrong with my commit, it is the code from another bug. I will commit again with the right code. :)

Comment 12

[:ingrid]

Attachment: "Bug 1605831 - SSL Certificates: Don't automatically check checkbox to send URLs to Mozilla if "Send Technical & Interaction Data to Mozilla" setting is disabled. r=prathiksha"

Comment 13

[Johann Hofmann [:johannh]]

After some discussion we concluded that there's a lot of complexity in this bug, in both the work that's necessary to complete it and also the code that it will add. Reporting was recently disabled across the board in bug 1579906 and it looks like when we re-enable it, it might take a different form. Together that means there's no point in working on this at the moment.