282491 - Add a Phishing Notification Bar to the message pane

Status: RESOLVED FIXED

(Thunderbird :: General, defect)

Description

[Scott MacGregor]

Just like we have notification bars for junk mail and remote content, we should
have a bar for when we think a message is an e-mail scam.

Comment 1

[Scott MacGregor]

Attachment: first pass at a phishing Bar implementation

We need to decide several things:

1) Do we want to add a button to the bar that when clicked takes you to a web
page on our site that talks about phishing for end users?

2) OR should we have a button in this phishing bar that allows you to override
our decision that this is an email scam like we currently do for over riding
the junk status and remote content. 

I'm leaning towards YES on Option #2 instead of Option #1

3) Is the wording ok or do we need to be more verbose: "Thunderbird thinks this
message is an email scam." 

4) Will need to talk to Arvid and Kevin about an icon for the phishing bar. I'm
currently re-using the remote content image.

Comment 2

[Scott MacGregor]

Attachment: screen shot

Comment 3

[Scott MacGregor]

Comment on attachment 174513 [details] [diff] [review]
first pass at a phishing Bar implementation

you can't tell from the diff but 

gMessageNotificationBar.setPhishingMsg(aUrl);

is being called from:

// this is called when layout is actually finished rendering a 
// mail message. 
function OnMsgParsed(aUrl)

so we are sure the DOM exists for the message before we look for phishing URLs.

Comment 4

[David :Bienvenu]

Comment on attachment 174513 [details] [diff] [review]
first pass at a phishing Bar implementation

thinks this message is an email scam.

perhaps instead of "is" "might be". Your call...

Comment 5

[Scott MacGregor]

the initial implementation patch has been checked in with David's suggested
wording change which I like. 

Comment 6

[Scott MacGregor]

Attachment: style the message notifications bars with native theme InfoBackground look and feel

An experiment on Windows and Linux, get rid of the separate toolbar colors for
junk mail, remote content and phishing, unifying them all to have
InfoBackground style rules like the Firefox browser message bar.

Comment 7

[Ryan Holliday]

Just a comment as I realize this is still a work in progress.  Today I received
a valid email from Fidelity using the 2005-02-18 nightly.  This email contained
a form to search fidelity.com (bad idea, but it did) which I think triggered the
phishing detector.  That in itself isn't such a bad thing, but the phishing bar
blocked the image bar ([Patch: make sure the phishing bar always takes
precedence over the remote image bar.]) so there was no obvious way to display
the images for the email, making it unreadable.

Implementing "2) OR should we have a button in this phishing bar that allows you
to override our decision that this is an email scam like we currently do for
over riding the junk status and remote content." and then displaying the
"Display Images" bar would solve this issue.

Comment 8

[Scott MacGregor]

your right that furthers the argument that we should have a "Not an E-mail Scam"
button in the message bar to clear the alert...

Comment 9

[Scott MacGregor]

Attachment: add a button to say this msg is not a scam and then remember that setting

adds a button to the phishing bar that you can click to say this message is not
a scam. That causes us to reload the msg, such that if it has remote images
you'd next see the remote images bar, then you'd reload it again to actually
see no messages....

I'm writing a custom integer property on the msg hdr called "notAPhishMessage"
to remember this value for the msg.

Comment 10

[Scott MacGregor]

I wonder if a user says the msg is not a scam if we should also set the "allow
remote content" field as well so he/she doesn't have to then turn around and
click the allow remote content button....

Comment 11

[Jerry Baker]

(In reply to comment #10)
> I wonder if a user says the msg is not a scam if we should also set the "allow
> remote content" field as well so he/she doesn't have to then turn around and
> click the allow remote content button....

No. The two are separate things entirely. I block remote content to stop Web
bugs - including those from people who email me regularly. I think it's better
to leave separate features separate and not try to guess what the user is trying
to do.

Also, see bug 282985

Comment 12

[David :Bienvenu]

Comment on attachment 174906 [details] [diff] [review]
add a button to say this msg is not a scam and then remember that setting

obsolete request