683779 - Email Addresses Can Only Be Submitted over HTTPS

Status: VERIFIED DUPLICATE of bug 694982

(www.mozilla.org :: General, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

http://www.mozilla.org/en-US/firefox/fx/ will display a page that accepts the user's email address.  This page must always be served over HTTPS. In addition, the page must also post the user's credentials over HTTPS. 

Steps to reproduce:
1. Go to http://www.mozilla.org/en-US/firefox/fx/
2. If you don't see the email submission form then reload the page (its designed to appear 50% of the time)
3. Notice the view source shows the form action of 
      <form action="/en-US/newsletter/" method="post" id="newsletter-form">
which will post over HTTP


Recommended Remediation

The email submission page and form action must always be HTTPS.

Comment 1

[Reed Loden [:reed]]

The footer for almost every page on mozilla.org (formerly mozilla.com) has a newsletter box, yet as far as I can tell, HTTPS is not used for that. Basically, in order to meet this requirement, every page on the site would need to be over SSL, which while being great from a security perspective, is most likely not going to be possible due to performance reasons, though IT will obviously have more definitive numbers and info on this.

Comment 2

[Michael Coates [:mcoates] (acct no longer active)]

(In reply to Reed Loden [:reed] (very busy) from comment #1)
> The footer for almost every page on mozilla.org (formerly mozilla.com) has a
> newsletter box, yet as far as I can tell, HTTPS is not used for that.
> Basically, in order to meet this requirement, every page on the site would
> need to be over SSL, which while being great from a security perspective, is
> most likely not going to be possible due to performance reasons, though IT
> will obviously have more definitive numbers and info on this.

Yea, this is a concern. I think for the splash page (which will generate a lot of traffic) we should force ssl. I understand the footers are not optimal, but not something we can address at the moment.

Comment 3

[Michael Coates [:mcoates] (acct no longer active)]

We can also change the footers and hardcode the form action to HTTPS.  This certainly doesn't protect against a MITM (they could just change the original page response over HTTP and remove the https), but it does prevent a large number of clear text email addresses being sent.

Comment 4

[mcbmoz]

Adding Raymond and Stephen here as well.

Comment 5

[James Long (:jlongster)]

I never registered to me that email addresses are that sensitive, but that's good to know.

We can definitely change the form action to https. We'll need someone from IT to way in on forcing the splash page to SSL.

Comment 6

[mcbmoz]

Adding one more to this one - there's an extra email sign-up on http://www.mozilla.org/en-US/firefox/channel we need to catch as well.

Comment 7

[James Long (:jlongster)]

This has been fixed in a bug reported during the security review of the pref center. We've moved most of the newsletter pages to force SSL.

This hasn't been pushed out yet but will be this week.

Comment 8

[David Lawrence [:dkl]]

Restoring unintended removal of in-testsuite flag.