393871 - Broken padlock icon at Ebay & Paypal

Status: RESOLVED WORKSFORME

(Toolkit :: Safe Browsing, defect)

Description

[Dianne Fox]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6

Hi

Problem is with the ebay site.When you go to secure mode to pay via ebay payments & then onto Pay Pal,both sites display a broken padlock indicating they are not secure.
I have to switch to IE7 to resolve in order to complete the transaction.

Thanks

Dianne

Reproducible: Sometimes

Steps to Reproduce:
1.buy on ebay
2.click pay now against seller
3.next page & onto paypal display broken padlock
Actual Results:  
After logging out of Mozilla & into IE7 then back into Mozilla the problem had resolved itself.

Expected Results:  
Mozilla had reset

Happens now & again on Ebay & Pay Pal only.Given that i have just had a phishing scare on Pay Pal it concerns me that Firefox isn't as secure as it should be.


Thanks

Dianne

Comment 1

[:Gavin Sharp [email: [e-mail]]]

Not a security-sensitive issue. Can you reproduce this problem consistently? If so, does running Firefox in safe mode help? See http://kb.mozillazine.org/Safe_Mode for details on running Firefox in safe mode.

Comment 2

[Daniel Veditz [:dveditz]]

A "broken" padlock indicates a mixture of secure (https) and insecure (http) items. It does not mean Firefox is insecure, it's Firefox attempting to warn you that the site itself is potentially insecure (because the content loaded insecurely may be able to alter the other supposedly secure bits).

IE has three behaviors in this mixed case, go ahead and load the insecure content (usually images), ask first, or simply suppress the insecure content. I believe the default behavior was changed in IE7 to the last option and that is what we're planning to do with Firefox 3.

It's also possible that the site is perfectly fine and Firefox is incorrectly detecting http content on an https site, but that seems unlikely -- either there are http urls or not. Should be tested though.

Comment 3

[Aakash Desai [:aakashd]]

Oh, so this worked for me when using paypal and ebay this weekend per Mr. Veditz's comments. I'm moving this to resolved:worksforme as a result. If there any qualms about this status, please feel free to bring them up!