415282 - Larry UI for Owner shows "No Information Provided," but Page Info says differently

Status: RESOLVED FIXED

(Firefox :: Page Info Window, defect)

Description

[Marcia Knous [:marcia]]

Attachment: Screenshot

Seen using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b3pre) Gecko/2008020104 Minefield/3.0b3pre.

STR:
1. Go to a bugzilla bug and click on the Larry UI
2. Notice under "which is run by" it says "No Information Provided"

Expected: I would see Mozilla Corporation, since that is what Page Info shows.

Comment 1

[Reed Loden [:reed]]

It's because the cert for *.mozilla.org is missing a valid CN.

Comment 2

[u60234]

Is this not the intended result for domain validated certs where the owner may not have been verified by the issuer?

Though it is of course not optimal that Larry and Page Info disagree on this.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

I could have sworn there was a bug about making the Larry and Page Info CN handling consistent, but I can't find it. Perhaps I'm just remembering a conversation with Johnathan.

Comment 5

[Johnathan Nightingale [:johnath]]

This dialog is actually browser/ code, moving -> Firefox

Comment 6

[Johnathan Nightingale [:johnath]]

Attachment: Check EV status in page info

This changes the logic for the page info text to more closely reflect the approach in primary chrome.  That is, trust the Org field on EV certs, but not on DV.

Comment 7

[Dave Miller [:justdave]]

Suggestion: have Larry say "not verified" instead of "no information provided" if the info is present but it's not an EV cert.  Otherwise he's lying to you.

Comment 9

[Gervase Markham [:gerv]]

Does this patch fix the problem both on the Security tab and the General tab? (See bug 417215).

Gerv

Comment 10

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #9)
> Does this patch fix the problem both on the Security tab and the General tab?
> (See bug 417215).

Yes.

Comment 11

[Johnathan Nightingale [:johnath]]

Attachment: Fix general tab handling

(In reply to comment #10)
> (In reply to comment #9)
> > Does this patch fix the problem both on the Security tab and the General tab?
> > (See bug 417215).
> 
> Yes.

Well.  Sort of.  :)  I did make sure to check that that string picked up changes, but actually looking at it on a DV-SSL site made for a pretty ugly:

"This web site is owned by This web site does not supply identity information."  

Updated patch does the right thing here, and just uses:

"This web site does not supply identity information."

on pages where no verified identity information is supplied.  This version also has ui-r beltzner, so I'm setting the flag.  I'll get gavin to take another quick review. 

(In reply to comment #7)
> Suggestion: have Larry say "not verified" instead of "no information provided"
> if the info is present but it's not an EV cert.  Otherwise he's lying to you.

I agree that the current text is technically incorrect, but I would propose that you file a separate bug for that.  It's a string change, which means late-l10n, where the rest of this bug doesn't require that.  And it's a subtle semantic point, so I can imagine several rounds of wordsmithing (e.g. do we really want to say "not verified" right above the line where we tell them who verified it?).

Fundamentally, I'm okay with the incorrectness here.  This is an identity UI, not a certificate viewer.  If a technology like TLS-SRP comes along that doesn't use certificates, but nevertheless allows for session integrity and identification, I'd imagine that would be at home here too.  We don't have *identity* information here that we can supply to our users, we just have some fields in a certificate from a CA who, in many cases, has told us up front they don't verify those fields.  Technically information has been provided, that's why I think filing a follow-up makes sense - we might find language that makes us happy as purists while still keeping things simple for users, but whether or not we do so is basically orthogonal to fixing the Larry/Page Info inconsistency.

Comment 12

[Johnathan Nightingale [:johnath]]

Comment on attachment 303086 [details] [diff] [review]
Fix general tab handling

I thought beltzner already approved this, but apparently I am crazy?

Comment 13

[Johnathan Nightingale [:johnath]]

Checking in browser/base/content/pageinfo/security.js;
/cvsroot/mozilla/browser/base/content/pageinfo/security.js,v  <--  security.js
new revision: 1.16; previous revision: 1.15
done