564600 - Show certificate information for all resources contained within a site

Status: RESOLVED WORKSFORME

(Core Graveyard :: Security: UI, enhancement)

Description

[Lars G. Sander]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

I have a startssl certificate installed for the "main" site and I pull the mootools.js file from "https://ajax.googleapis.com/ajax/libs/mootools/1.11/mootools-yui-compressed.js" (providing a different cert). 

Only a closer look at the content will reveal that information is being pulled from a (sub|different) server.

Reproducible: Always

Steps to Reproduce:
1. Create a page on SSLed server, include other SSLed content (e.g. mootools*.js)
2. Surf to page, only main cert will be presented, no message about mixed content
Actual Results:  
While the whole content is encrypted, it is done so under two different certificates - presenting only the "main" cert to the user and not breaking the blue/green encryption signage in FF's location bar.

Risk: 
This could enable an attacker to forge content on his SSLed server and include it on the hijacked server, thus serving hostile content to a user.

Expected Results:  
Suggestion 1:
Break the green/blue encryption signage bar (for the lack of the common term) if content is provided by more than one cert'ed server.

Suggestion 2:
Provide "mixed encrypted content" message to user.

Alternative:
Break the encryption signage bar only if content is not provided from the same URL.

Comment 1

[Jesse Ruderman]

The change you're proposing would break most SSL web sites and I don't think it would improve security. It's the site owner's responsibility to only include content from servers they trust.

Comment 2

[Lars G. Sander]

I agree - that would be massive and the content _is_ encrypted afterall. And it is this little things that soften up the end-to-end encryption context: It is not end-to-end but more a triangle (and more) encryption|relationship.

The owners trust is not the question here (they've been hacked already) - it is about rogue content running under the security context of the main sites cert. There is no mechanism in FF to protect from or highlight that.

Then what about the "mixed (encrypted) content" message and showing the certs that are "engaged"? That would reflect reality better than today's situation does.

Comment 3

[Josh Triplett]

Per comment 2, I've retitled this bug to request that Larry and Page Info show information about all the certificates the user must trust to use the page, not just the certificate for the site itself.  This situation remains acceptable, but the user should have some way to find out that they have to trust more than just the site owner's certificate.

Comment 4

[Dana Keeler (she/her) [:keeler]]

The network panel in the devtools provides this information.