41863 - Padlock icon showing mixed or unlocked for secure sites, no security warning message when entering site

Status: VERIFIED WORKSFORME

(Core :: Security: PSM, defect, P3)

Description

[cheng]

For two sites that I frequently access:

https://webbanking.tdaccess.com/
https://webbroker1.tdwaterhouse.ca/

Mozilla always show the padlock icon with a red line through it. When I clicked
on the icon, PSM says that the site does not support authentication or
encryption. I don't know of other sites with the same problem. I can access
these sites fine with Netscape 4.73 just fine, and Netscape 4.73 says that the
site's certificates and encryption are just fine.

Comment 1

[Asa Dotzler [:asa]]

setting bug status to New

Comment 2

[John Unruh]

Assigning to dougt. There does not appear to be any insecure content on 
https://webbanking.tdaccess.com/.

Comment 3

[Doug Turner (:dougt)]

Reassigning all https/cartman/security bugs to valeski.  He will be finding new 
owner(s).  This shift is so that I can focus on embedding issues.  If the new 
owner has questions that can not be resovled, I may be able to lend a (quick) 
hand.

over to valeski....

Comment 4

[Jay Patel [:jay]]

Putting on [NEED INFO] radar. PDT needs to know impact to user and risk of fix 
to make a call on this bug. Can we get this tested with the latest builds and 
get and updated status on this problem.

Comment 5

[John Unruh]

This is still happening with today's builds. The impact to the user is that he 
can get the impression that entering his password to login to his bank account 
is insecure, even though the site really is secure. 

Also, if you click on the lock icon, you can read "The web site 
webbanking.tdaccess.com does not support authentication for the page you are 
viewing." This is incorrect. It should say "The web site webbanking.tdaccess.com 
supports authentication  for the
 page you are viewing. The identity of this web site has been verified by
 OU=Secure Server Certification Authority, O="RSA Data Security, Inc.",
 C=US, a certificate authority you trust for this purpose. "

Comment 6

[Jay Patel [:jay]]

Putting on [nsbeta2-] radar. Not critical to beta2.  Adding "nsbeta3" keyword 
for consideration of a fix for that milestone. 

Comment 7

[R.K.Aa.]

this is still valid on 2000-070220. What's more - i suspect the output is right
about the transaction being insecure - i couldn't see the usual psm processes
running with a ps -ef
What indicates it's a secure transaction at all? All output indiactes the
contrary. I wouldn't dare use this one for my bank transactions currently.

This is the info i get from PSM:

Web Site Identity Not Verified
The web site web.nor.no does not support authentication for the page you are
viewing. Without authentication, the origin of information sent over the
Internet cannot be verified. Connection

Not Encrypted
The web site web.nor.no does not support encryption for the page you are
viewing. Information sent over the Internet without encryption can be seen by
other people while it is in transit.

Comment 8

[cheng]

I just checked on 2000070120, and I can certainly see the psm processes
running.  What's more is that the page took extremely long to load, just like
any other encrypted page.  And it seems to me that it is probably encrypted...

Comment 9

[cheng]

An interesting note:  when I log out of the banking site, I got to the page at:

  https://www.tdbank.ca/webbanking/logout/index.html

and if you click on the padlock it shows that everything is encrypted.

Comment 10

[John G. Myers]

Could this be an instance of bug 45337 ?

Comment 11

[fig\tree]

on the order page for http://www.omnisky.com/products , there is no popup
message telling the user that the site is secure, plus the padlock icon does not
change at all. but if you hit continue w/o entering more info, the error page
does show up w/ the right security padlock, still no "this site is secure" popup
message though. This is on a cvs Linux build from 0720.
https://www.microsoft.com exhibits that red cross behavior.

Comment 12

[John G. Myers]

This also occurs on https://scopus.mcom.com/bugsplat
I have confirmed this is caused by bug 45337.

Comment 13

[Doug Turner (:dougt)]

another problem is that we are check the flags on flag_is_request not
flag_is_network.  I am attaching a diff which will fix some of the problems.

Comment 14

[Doug Turner (:dougt)]

Attachment: fixes flag_is_request checks

Comment 15

[John Unruh]

Worksforme now.

Comment 16

[John Unruh]

Verified with the 081804 Win32 and Linux builds.