View Site Certificate

[vesta0]

Why/User Benefit/User Problem

User Story

As a user, I want to be able to view the site certification, so I have more control and transparency over my browsing experience.

Dependencies:

• [Meta] Site Verification #5073 initial phase
• Implement Alert Page Template and Update Alerts #5892 Error pages is landed

Acceptance Criteria

-I can view the certificate for each site that I browse.

┆Issue is synchronized with this Jira Story

[mcarare]

@vesta0 Is there anything left to do here?

[vesta0]

@mcarare this feature has not been built yet (can't view site certificate in mobile) but it's also not a priority for now that we have the "verified by" part in the app.

[oakkitten]

the "verified by" part

perhaps the bigger problem is when the certificate can't be verified. if trust anchors are missing, or even if your clock is wrong, you are getting the same generic message with the only option to “accept the risk and continue”. no certificate information whatsoever, not even any clue as to what exactly went wrong.

even more surprisingly, when you do in fact “accept the risk and continue”—without knowing what risk you are accepting—the app shows you the lock icon 🔒, and if you tap on it, you can see that the connection suddenly became “secure” and “verified”... !?

...that is, if the button works at all. i've got a website that upon clicking “accept the risks and continue” simply displays the button again. so i have no idea what's going on there.

compare this to chrome that not only displays the certificates in all cases—even when they can't be verified—but also shows helpful messages such as “your clock is behind”. and it also displays a warning icon ⚠ in the toolbar instead of the lock if you decide to accept the risks.

[madb1lly]

Hi @oakkitten,
Lots of good observations and suggestions. If there aren't already issues raised for them then I suggest you raise them separately as that's the best way to get them considered and treated.
Cheers 🙂

[april]

I've had a bunch of people email me about this today. I think all the code for about:certificate is there, it just seems like it's not wired up to the UX.

[clientenq]

How can we get this implemented asap?
The public key infrastucture requires users are able to verify certificates, not only to trust an application handling specific tasks based on pki.
Currently firefox removed the control from the user to verify any certificate. We should not develop or release like users do not need control over basic security mechanisms or do not be able to view technical details of core www functionality.

[andreicristianpetcu]

A workaround in nightly https://twitter.com/FirefoxPreview/status/1313128741208502272
https://blog.mozilla.org/addons/2020/09/29/expanded-extension-support-in-firefox-for-android-nightly/

[PeopleInside]

A workaround in nightly https://twitter.com/FirefoxPreview/status/1313128741208502272
https://blog.mozilla.org/addons/2020/09/29/expanded-extension-support-in-firefox-for-android-nightly/

This is not working on latest stable version of Firefox for Android.

[andreicristianpetcu]

It works on latest Nightly version which is a good workaround for a lot of people until it gets implemented.

[thw0rted]

Just to expand on this, in case anybody still thinks that showing "verified by" is enough for most users and this shouldn't be high priority: anybody can go out and register famouscompany.info then send phishing links to famouscompany.com users. I guarantee they'll get a cert from a trusted issuer, at least for a while.

Worse, plenty of major companies do buy and use other TLDs -- I came to this issue because Asus sent me an email with a link to asus.me. The only way to know if the site is legit is to look at the full certificate details. That's why it's absolutely critical to user security that they be able to see this:

and it's just not safe to use a browser that does not have this feature.

[DrekiDegga]

I don't understand how the lack of a core security functionality in a browser that used to bill itself as one of the most secure could be considered "not a priority"

Being able to view detailed certificate information, not just who issued it, is critical to the functionality of the HTTPS and SSL trust model. And the fact that this "feature request" is over a year old is proof of how far Mozilla has fallen. It is truly sad.

[thw0rted]

I try to keep a civil tone, and I generally disapprove of people feeling entitled to whatever feature they want from an open-source project when people are volunteering their time to maintain it. But this is actually a really big deal. Like Dreki, I also am genuinely sad that Firefox -- the browser to beat when the internet came into its own in the early 2000s, the one we all rallied around in the bad old days when IE set the standards -- that Firefox has glaring omissions like this one. I understand the negative reaction, it's really frustrating that I feel stuck with Chrome, because every time I try to switch back to FF I run into a problem like this one, and I either find an issue marked "wontfix", or an open ticket with no activity for several years. (My record for this exact situation is 14 years.)

[DrekiDegga]

Are there any updates on this?
I am still not understanding how this isn't a priority. The ability to verify the website your visiting is genuine and your connection hasn't been tampered with or "inspected" is a basic, essential security function of a web browser.

Edit: Related reading https://www.ise.io/casestudies/fighting-back-against-ssl-inspection-or-how-ssl-should-work/index.html

It seems like we are losing control or knowledge over things like what root CAs or sub CAs, certificate chains and now we are just supposed to trust and not ask questions about how the security of our personal data was verified.

[DrekiDegga]

Just thought I would provide more examples of why this egregious security oversight that is "not a priority" should probably be fixed.

https://freedom-to-tinker.com/2022/03/09/attackers-exploit-fundamental-flaw-in-the-webs-security-to-steal-2-million-in-cryptocurrency/

https://community.letsencrypt.org/t/using-bgp-to-acquire-bogus-tls-certificates/38627

Just to be clear "verified by" provides exactly zero protection against this attack.

Core security functionality has now been missing from Firefox mobile(and most other mobile browsers) for over two years

[thw0rted]

I generally agree that FF still needs to implement this feature, but the article you linked to describes an issue that the user agent simply can't address. No browser on desktop or mobile is going to show the user the CA chain used by every CDN server that contributed resources to the page, and of course no user is going to check all of them manually on every page load. The article is right that more secure DNS (and IMHO broad adoption of certificate pinning) would solve the fundamental problem, moreso than anything the browser could do.

(At least you can probably answer your previous question about whether your connection is being inspected by your workplace now, since they added "Verified By" at some point.)

[jonalmeida]

Moved to bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1813945

Change performed by the Move to Bugzilla add-on.