288693 - Warn on low security SSL sites

Status: RESOLVED DUPLICATE of bug 799007

(Core Graveyard :: Security: UI, enhancement)

Description

[Doug Wright]

When visiting 'secure' sites that use outdated encryption, Firefox/Thunderbird
should give a big ugly warning about the dangers of submitting information to
this site.

For reference: the latest Opera 8 beta does this and displays the message

'This site is using an outdated encryption method currently classified as
insecure. It cannot sufficiently protect sensitive data. Do you wish to continue?'

In Opera, the message must be OKed/cancelled *before the site is even rendered*

My personal preference would be a dialog with a delayed OK button (like
XPInstall) to force people to read it.

(URL is to a Opera forum thread discussing this)

Comment 1

[Gervase Markham [:gerv]]

Just FYI, delayed OK buttons are not about forcing people to read the dialog.

We should roll this idea into our thinking about how to change the SSL UI, but
it's not a 1.1 blocker.

Gerv

Comment 2

[Kai Engert (:KaiE:)]

This bug depends on bug 62178, which is about being able to cancel a transition
between secure and insecure sites.
 

Comment 3

[Kai Engert (:KaiE:)]

While we still need bug 62178 to address Gerv's point that canceling is
currently not possible, I just remember we already have this "low security
warning" feature!

In SSL prefs there is a checkbox to enable low grade encryption warnings.

However, the barrier between low grade and high grade encryption is currently
set to be at 90 encryption bits.

See security/manager/ssl/src/nsNSSCallbacks.cpp in HandshakeCallback.

Nelson, do you think this barrier should be changed?
What value would you suggest?

Comment 4

[Gervase Markham [:gerv]]

FWIW, my current thinking is that sites with poor encryption should be treated
as if they were plain HTTP in terms of the UI.

Gerv

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Kai, Good to hear from you again.
90 bits seem slike a good threshhold to me.  

Comment 6

[AndrewM]

This was fixed in bug 236933 was it not?

Comment 7

[Kai Engert (:KaiE:)]

reassign bug owner.
mass-update-kaie-20120918