The default bug view has changed. See this FAQ.

Mixed content explanations misleading

NEW
Unassigned

Status

()

Firefox
Security
10 years ago
2 years ago

People

(Reporter: Adam Barth, Unassigned)

Tracking

({uiwanted})

Trunk
uiwanted
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(1 attachment)

(Reporter)

Description

10 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9

The descriptions of mixed content in the Firefox user interface are misleading.  The current explanations emphasize the confidentiality but do not mention integrity even though integrity is essential to the security of the browsing session.

By not explaining the threat correctly, the browser is mis-educating site developers and encouraging them to continue building insecure sites.  In particular, it is not clear why embedding an http script in an https page is dangerous.


Reproducible: Always

Steps to Reproduce:
1) Navigate to <https://www.stanford.edu/~collinj/research/mixed.html>.
2) Click on Larry.
3) Click on learn more, etc.
Actual Results:  
The text describes confidentiality only---ignoring integrity.

Expected Results:  
The text should consider that an attacker might modify the content as it travels over the network.
(Reporter)

Comment 1

10 years ago
Created attachment 288460 [details] [diff] [review]
Proposed changes to explanations.

Attached are our proposed changes to the explanations.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: uiwanted
Version: unspecified → Trunk
You need to log in before you can comment on or make changes to this bug.