531509 - UI issues with invalid certificates dialog

Status: NEW

(Thunderbird :: Security, defect)

Description

[Simon Bünzli]

Steps to Reproduce:
1. Try to fetch e-mail from a TLS secured server with an invalid (expired) certificate

Expected result:
Thunderbird informs that the certificate expired and - optionally - allows to ignore the exception and maybe informs how to make that exception persistent.

Actual result:
Thunderbird asks to confirm the exception (as if that were the rule!) and makes persisting that decision opt-out(!). Had I not accidentally cared to actually read the dialog, I'd never have known what hit me and would have continued using an invalid cert without any further indication.

Also, the most important information ("Certificate expired" or "Domain mismatch") is quite well hidden. Rather, the main message is that "Banks, serious business, etc. don't ask you to do 'this'" - whatever 'this' may be.

Considering that the use of TLS protected connection is currently being promoted even by freemailers, TB3's UX is quite awful. As a short-term measure without l10n-impact, could at least the opt-out be changed to an opt-in for persisting the decision?

Asking for blocking-thunderbird3 for lack of a better option (either wanted-tb3 or wanted-tb3.1).

Comment 1

[Simon Bünzli]

Thunderbird 2.0 at least doesn't allow to add a permanent exception, forcing you do repeatedly take the (nonetheless) default action: to continue anyway.

Comment 2

[Justin Dolske [:Dolske]]

I just hit this dialog when mail.mozilla.com's presented an expired cert during today's upgrade/outage. (As part of an endless loop, bug 531549, ugh).

I'll second that this is confusing UI, and the particular bug I hit basically forces you to add the override if you want to do anything else in TB. Seems like there should be some plain notification before this, before dropping the user into an action-oriented dialog. EG, a simple "The server's certificate has expired. [Try Later] [Add Exception]" dialog.

A few other points to mull:

* May want to have different UI paths for first-setup vs. existing-account. I think this has been discussed elsewhere, in the context of being more permissive for first-setup (where errors are almost certainly just a server problem, and not an attack).

* Probably shouldn't store these as permanent exceptions. The reasoning for doing so in Firefox was that repeatedly adding temporary exceptions trains users to ignore SSL errors, so that after doing it over and over on https://broken.favorite.site they do it out of habit when they get MITM'd on https://bank.com. Mail users only have a few accounts, so this doesn't apply.

* May want to treat expired certs as a special case, and store the override for a couple days if it recently expired (under the assumption that IT guys will be fixing it quickly).

Comment 3

[Ludovic Hirlimann [:Usul]]

How is this different than bug 316062 ?

Comment 4

[Mark Banner (:standard8)]

Not blocking Thunderbird 3.0 on this, especially as we don't have control of the dialog (it is in core) and we're string frozen.

We do need to consider this going forward in TB 3.1 and later so nominating for blocking 3.1 so that we consider and think about a roadmap for our PSM integration.

Comment 5

[Dan Mosedale (:dmosedale, :dmose)]

Yuck, this is nasty.  Since we might well need string changes to fix this, aiming at beta 2.  Adding regressionwindow-wanted, as figuring out exactly which code changed tweaked the UX here might help narrow down how to address it and who to talk to.

Comment 7

[Dan Mosedale (:dmosedale, :dmose)]

UnDUPing, aiming at B2, and giving to Mark to start with, based on IRC discussions.  As we're not 100% sure that this is the same issue, though it does seem likely.

Comment 8

[Dan Mosedale (:dmosedale, :dmose)]

We're resetting the blocking flag for 3.1 on this bug and instead setting the wanted-thunderbird+ flag. We have too many blocking-3.1 bugs, to the point where it doesn't mean much, and managing the list is making it hard to actually work on closing bugs, which helps no one.

Thunderbird 3.1's primary purpose is to allow us to offer a prompted major update to Thunderbird 2 users, to ensure their continued ability to safely use Thunderbird.  Thunderbird 2 is built on an outdated version of Gecko, and our long-term ability to maintain the users' safety for Thunderbird 2 users is limited.

If you think this bug meets the requirements below, please renominate with a detailed explanation of how it meets the following two criteria, and we will reconsider.  To qualify, this bug must either:

a) make the upgrade experience from TB2 very painful for a large number of users

or

b) be a new, reproducible, severe quality issue (eg dataloss, frequent crashes)

Just because this bug doesn't block TB3.1 doesn't mean it can't or won't make the release.  Once they're done with their blockers (if any), we encourage developers to keep working on non-blocking bugs, and to try to land them as early in the cycle as possible, as non-blocking bugs will become increasingly difficult to land in the later stages of the cycle.

Comment 9

[Bert Forbes]

Attachment: screen snip of hung endless loop error state/message

Eudora 8 Beta 8 error window that won't close

Comment 10

[Bert Forbes]

I'm new to bug reporting, so I hope I don't do something wrong with this. I am using Eudora 8 Beta 8 on Windows 7. Today I received an email that when I highlighted it, the preview came up, but I got an error message about an invalid certificate. I checked the certificate and it looked ok to me, but I'm not a power user. I then clicked on 'cancel' and the screen blinked, but the same error message came right back up. I couldn't get to any other mail boxes, nor could I close Eudora. I had to go to Task Manager and end task. I've attached the snip of the screen with the error message:

Comment 11

[[:Aureliano Buendía]]

(In reply to comment #3)
> How is this different than bug 316062 ?

+1

Simon do you agree that this is a dupe of bug #316062?

Comment 12

[Simon Bünzli]

(In reply to comment #11)
AFAICT, bug 316062 is about a change to the Mail Account Settings dialog (invalid *S/MIME* certificates) while this one is about a different dialog that only gets presented when a server's *SSL/TLS* certificate is invalid. So I don't see much of a connection between these two bugs at all.

Comment 13

[Kai Engert [:KaiE:]]

Yes, S/MIME and SSL/TLS are different categories.

Yes, we need better UI treatment when noticing bad server certs.
See also bug 664634 comment 4 for some other thoughts from today.