61467 - SSL connection is lost during banking transactions on this site

Status: VERIFIED DUPLICATE of bug 31982

(Core Graveyard :: Security: UI, defect, P3)

Description

[Scott MacGregor]

Go to the above url.

Notice that we have an SSL connection to the server.

Click on the demo account.

Now click on some of the links for getting an account statement, etc. Notice
that the secure lock icon briefly goes away and then comes back. (That part is
okay) But then it immeidately turns into a RED broken lock.

It's impossible to perform any actions on this banking site without dropping the
SSL connection.

I have not verified if the problem is just with us changing the icon to the red
broken lock or if the SSL connection really is gone yet.

Comment 1

[Darin Fisher]

Watching the network traffic with ngrep, I didn't see any plaintext packets
going by... which leads me to think that we still have a SSL connection.
There also definitely isn't any activity on port 80.  I'm not convinced that
this proves anything.

When I open up the PSM window, by clicking on the red pad lock, it claims that
the connection is not encrypted... that the site has not provided
authentication.

Perhaps PSM is just incorrectly reporting its state???

Comment 2

[John Unruh]

This is actually a duplicate of bug 31982. The SSL connection is not lost, but 
the lock icon is showing "mixed content". See bug 31344.

Comment 3

[John Unruh]

*** This bug has been marked as a duplicate of 31982 ***

Comment 4

[John Unruh]

Verified dupe.

Comment 5

[John Unruh]

Mass changing Security:Crypto to PSM

Comment 6

[John Unruh]

Mass changing Security:Crypto to PSM