User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:22.214.171.124) Gecko/20071025 Firefox/126.96.36.199 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:188.8.131.52) Gecko/20071025 Firefox/184.108.40.206 The descriptions of mixed content in the Firefox user interface are misleading. The current explanations emphasize the confidentiality but do not mention integrity even though integrity is essential to the security of the browsing session. By not explaining the threat correctly, the browser is mis-educating site developers and encouraging them to continue building insecure sites. In particular, it is not clear why embedding an http script in an https page is dangerous. Reproducible: Always Steps to Reproduce: 1) Navigate to <https://www.stanford.edu/~collinj/research/mixed.html>. 2) Click on Larry. 3) Click on learn more, etc. Actual Results: The text describes confidentiality only---ignoring integrity. Expected Results: The text should consider that an attacker might modify the content as it travels over the network.
Attached are our proposed changes to the explanations.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Version: unspecified → Trunk
You need to log in before you can comment on or make changes to this bug.