4 ms·
Mozilla, as far as I know, isn't beholden to any consumer sites for revenue? Instead of a generic "Something went wrong" TLS error message that's Greek to norm
by ethbro 8y ago
Mozilla, as far as I know, isn't beholden to any consumer sites for revenue?
Instead of a generic "Something went wrong" TLS error message that's Greek to normal users and potentially causes blame to the browser, get aggressive.
At this point, it's laziness or incompetence.
--
"Warning: [WHOIS_COMPANY_NAME] is using a vulnerable certificate from Symantec. Criminals may be able to read anything you do on this site.
Please email [WHO_ADMIN_CONTACT_EMAIL] about securing their site. Click [here] for more information about why Symantec certificates are no longer trusted."
- robin_reala 8y agoThe actual Firefox message for a site using a Symantec cert on today’s nightly: Warning: Potential Security Risk Ahead Nightly detected a potential security threat and did not continue to [site].com. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details. Websites prove their identity via certificates, which are issued by certificate authorities. Most browsers will no longer trust Symantec, the certificate authority for [site].com. You may notify the website’s administrator about this problem.
- londons_explore 8y agoI'd much prefer the browser continue to the site, but clear all cookies, treat the domain as an untrusted origin (so all CORS requests fail), and as soon as the user tries to type anything, pop up a big security warning saying "This site isn't secure! You shouldn't put any private data, passwords, or credit card numbers in". Then disable the keyboard entirely.
- ethbro 8y agoDisplaying the site but mangling functionality runs the risk of shifting blame to the browser, which I think is the primary tightrope in their mind. "Firefox won't let me do this" vs "ING's page is broken"