[browser] Various issues with security UI's

[Chris Coulson]

I've not done a proper review on this yet, but there are a few issues I've noticed just from using the browser:

- The certificate error UI is displayed for all errors, but it should only be displayed for main frame document errors (CertificateError.isMainFrame && !CertificateError.isSubresource). You can't override other errors anyway, and for subframes and subresources it is fine to just block the content (this is how Chrome and Firefox behave).

- When accepting an error, the certificate fingerprint seems to be whitelisted by the browser. This is not safe - what happens if the user navigates to a genuinely malicious site that happens to use the same certificate? If you want to whitelist them, you must also record the domain that the error originated from and the error code, and only automatically allow the error if the domain + error code + fingerprints match

- When accepting an error, there is no visual cue in the header bar that you're on a site with security errors.

- If you press the stop icon in the addressbar whilst the certificate error UI is displayed, the pending navigation is cancelled (returning to the previous committed navigation), but the certificate error UI is not removed. There is a CertificateError.cancelled signal for this purpose - I'm not sure if you're using it or not

- There doesn't seem to be any indicator when you go to a site that has an EV certificate

--- UX Comment ---
Additional wireframe for top bar displaying warning when certificate identity is not verified
https://docs.google.com/a/canonical.com/presentation/d/1Qrd4Flfs3EH-fI79IfrYgLdAx2nce-L7ve8NKLCX324/edit#slide=id.g3503834cf_01

For EV certificate, just display EV information in the pop-over

[Chris Coulson (chrisccoulson)]

For point 4, there is actually an Oxide bug too (bug 1377198)

[Jamie Strandboge (jdstrand)]

Marking with ota-1-- we'd ideally have this for rtm, but it is ok if it comes in an OTA update. If ota-1 is too aggressive, feel free to adjust. Thanks!

[Olivier Tilloy (osomon)]

An additional issue that’s related to the implementation of the whitelist for invalid certificates that have been overridden for the duration of the session: the whitelist is stored on the webview, so if I open a URL for which the certificate has been previously whitelisted in a new tab, I will get the security warning page again. The whitelist should be stored on the browser object instead, so that all webviews share it for the duration of the session.

[Olivier Tilloy (osomon)]

> When accepting an error, there is no visual cue in the header bar that you're on a site with security errors.

The design specification doesn’t mention this situation, I’ll request an update. Out of curiosity, I tested firefox and chromium on desktop: firefox just pretends nothing happened if an exception was added (i.e. it says the connection is secure and displays a padlock icon), whereas chromium displays a padlock with a cross over it, and the "https" part of the address is striked through. Two rather different approaches.

[Olivier Tilloy (osomon)]

Added an ubuntu-ux task to the bug report so that design can chime in on those two points:

- When accepting an error, there is no visual cue in the header bar that you're on a site with security errors.

- There doesn't seem to be any indicator when you go to a site that has an EV certificate

[Olivier Tilloy (osomon)]

I’ve just tested chrome on android, and I’m not seeing any difference in the way EV certificates are displayed to the user (with respect to normal certificates). On desktop and tablets the name of the organization is displayed on the left of the URL, but obviously on phones there’s not enough real-estate in the address bar.

@Chris: any suggestion on how to visually differentiate normal certificates and EV ones?

[Launchpad Janitor (janitor)]

This bug was fixed in the package webbrowser-app - 0.23+15.04.20141212.1-0ubuntu1

---------------
webbrowser-app (0.23+15.04.20141212.1-0ubuntu1) vivid; urgency=low

  [ Olivier Tilloy ]
  * Optimize the capture functionality. (LP: #1359293, #1401045)
  * Record host and error code along with certificate fingerprint when
    whitelisting a certificate error. (LP: #1377194)
 -- Ubuntu daily release <email address hidden> Fri, 12 Dec 2014 17:23:40 +0000

[Olivier Tilloy (osomon)]

I’m now closing this bug. I filed bug #1402723 and bug #1402725 to track points 3 and 5 in the original description separately.

[Launchpad Janitor (janitor)]

This bug was fixed in the package webbrowser-app - 0.23+15.04.20141218~rtm-0ubuntu1

---------------
webbrowser-app (0.23+15.04.20141218~rtm-0ubuntu1) 14.09; urgency=low

  [ Leo Arias ]
  * Refactor the address bar autopilot helpers so they can be used from
    external test cases.
  * Expose on the autopilot helpers the back and forward functionality.

  [ Olivier Tilloy ]
  * Update translation template.
 -- Ubuntu daily release <email address hidden> Thu, 18 Dec 2014 18:40:11 +0000