165017 - Authorities List Changes Discarded

Status: VERIFIED DUPLICATE of bug 138818

(Core Graveyard :: Security: UI, defect, P3)

Description

[Ram Moskovitz]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826

After modifying the Authorities list (Trusted Root List) in mozilla 1.1R the
changes are discarded. Reopening the manage interface reveals they have returned.

Reproducible: Always

Steps to Reproduce:
1.Install mozilla 1.1r
2.Choose Edit->Preferences
3.Choose Privacy & Security->Certificates
4.Click Manage Certificates
5.Select the Authorities Tab
6.Select an entry (say ABA.ECOM Root CA - the first entry)
7.Choose Delete and Confirm OK
8.Confirm ABE.ECOM Root CA is no longer in the list - Good.
9.Close by hitting close box (methinks there should be OK and CANCEL to commit
and rollback for something this sensitive)
10. Perform steps 2 through 5 to arrive at the manage certificates.Authorities tab
11. Our deleted entryhas returned
Actual Results:  
User changes to authority list discarded. The deleted entry is reborn.

Expected Results:  
User changes to authority list saved. The deleted entry should not be seen again.


Personally I see this as a major bug because if one of the MANY entries in
authority list turned out to be a bad guy mozilla.org would have to churn out a
new build or patch to remove the entry as the user's method of doing so is
disabled. Also a user who may choose not to trust entities is not empowered to
do so.

I think it's a major bug - but I leave it to you to recategorize if you agree
(first bug report - I don't want to be obnoxious yet :)

Comment 1

[John Unruh]

Reporter, do a step 12, and edit the CA that has returned. Notice that it is no 
longer trusted. See comment 7 in bug 138818.

http://bugzilla.mozilla.org/show_bug.cgi?id=138818#c7

*** This bug has been marked as a duplicate of 138818 ***

Comment 2

[John Unruh]

Verified dupe.

Comment 3

[Ram Moskovitz]

Concurr (in FF 1.0.1). BTW I just got notice 20050308 but if unless I missed
something (totally possible) the change here was 20020919.