345124 - anti-phishing may pop up bad cert dialog when trying to get keys

Status: RESOLVED INVALID

(Toolkit :: Safe Browsing, defect)

Description

[Tony Chang (Google)]

The anti-phishing feature grabs keys from a remote server used to decrypt values in local tables and to encrypt urls when in "ask google" mode.  The keys are retrieved from www.google.com over https using XMLHttpRequest.  If the ssl cert doesn't match for some reason, the user gets a dialog asking if they want to accept a cert.  This is a poor user experience.

Rather than using XMLHttpRequest, we should use an nsIChannel with a nsIInterfaceRequestor that has a nsIBadCertListener.  See
http://lxr.mozilla.org/seamonkey/source/toolkit/mozapps/update/src/nsUpdateService.js.in#1674
for reference.

Comment 1

[Johnathan Nightingale [:johnath]]

This seems likely to be irrelevant when bug 388652 lands.  We should consider marking it WONTFIX/INVALID.

Comment 2

[Tony Chang (Google)]

It depends on whether Mozilla wants to validate the data from the update servers using a MAC.  In that case, we'd still need the key.

Comment 3

[Tony Chang (Google)]

For reference: http://code.google.com/p/google-safe-browsing/wiki/Protocolv2Spec section 4.

Comment 4

[Justin Dolske [:Dolske]]

Pretty sure this isn't a problem -- bad cert errors from XML haven't opened prompts in a long time.