403591 - Mixed content explanations misleading

Status: RESOLVED WONTFIX

(Firefox :: Security, defect)

Description

[Adam Barth]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9

The descriptions of mixed content in the Firefox user interface are misleading.  The current explanations emphasize the confidentiality but do not mention integrity even though integrity is essential to the security of the browsing session.

By not explaining the threat correctly, the browser is mis-educating site developers and encouraging them to continue building insecure sites.  In particular, it is not clear why embedding an http script in an https page is dangerous.


Reproducible: Always

Steps to Reproduce:
1) Navigate to <https://www.stanford.edu/~collinj/research/mixed.html>.
2) Click on Larry.
3) Click on learn more, etc.
Actual Results:  
The text describes confidentiality only---ignoring integrity.

Expected Results:  
The text should consider that an attacker might modify the content as it travels over the network.

Comment 1

[Adam Barth]

Attachment: Proposed changes to explanations.

Attached are our proposed changes to the explanations.