571179 - Nexus plugin crashes when trying to use it to log in to online bank

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Kai de Leeuw]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a5pre) Gecko/20100609 Minefield/3.7a5pre
Build Identifier: 

When I try to login to Skandiabanken, there are two possibilities:
* Login with a BankID, a shared login solution for most banks operating in sweden
* the old deprecated way, which is to have a certificate downloaded to the browser and verify against that certificate on subsequent logins

I am using the BankID login.

The BankID way uses a plugin (Nexus), that is not behaving like a usual plugin, because this one that opens up a window asking for your credentials, instead of being presented inside the browser like other plugins like Quicktime, flash etc.

When I use this to login in current trunk build, first it hangs, not letting me enter my password, and then presumably after 10 seconds, http://benjamin.smedbergs.us/blog/2010-06-09/the-firefox-plugin-hang-detector/, it "crashes", which means that a UI element is telling that the Nexus plugin has crashed and a button "Submit crash report" is also shown.

The problem is that the bank does a redirect and I never get a chance to press the button, which would explain why you never have received crash reports on this plugin.


Reproducible: Always

Steps to Reproduce:
Per instructions on the Bank site:
1. Download a BankID
2. Try to Log in with the BankID alternative

Actual Results:  
Crash.

Expected Results:  
No crash.

This is a bit hard to reproduce if noone working with triage has an account on that bank, I know, but that shouldn't stop me from filing this bug. ;)

Comment 1

[timeless]

https://developer.mozilla.org/En/How_to_get_a_stacktrace_with_windbg

if you need help doing this, please visit https://support.mozilla.com, someone should be able to walk you through it or connect you to someone who can walk you through it, be sure to reference this bug's id.

Note that you really should complain to your bank. We don't have good results contacting tiny bank creatures, they tend to insist that they only speak to customers....

Comment 2

[timeless]

actually, try loading: about:crashes if there are unsent crashes, you should be able to send them from that page...

Comment 3

[Kai de Leeuw]

(In reply to comment #2)
> actually, try loading: about:crashes if there are unsent crashes, you should be
> able to send them from that page...

http://crash-stats.mozilla.com/report/index/5eac7e70-6655-43de-9952-3bf882100610

Comment 4

[Kai de Leeuw]

(In reply to comment #1)
> Note that you really should complain to your bank. We don't have good results
> contacting tiny bank creatures, they tend to insist that they only speak to
> customers....

I doubt that this bug is only for Skandiabanken. 

This Nexus application (Nexus Personal) is used on very many sites for authentication. The customers are many (see http://www.nexussafe.com/en/Customers2/) so the impact of this remaining unfixed in 3.6.4 may be big among Firefox users.

Comment 5

[Kai de Leeuw]

wfm 3.6.4 and later