DO NOT SHIP THIS. Revert the change immediately and request a CVE number for the nightlies with this change included.
That Chrome does something harmful is not surprising, and is no justification for a supposedly independent browser to do the same. A policy of switching from positive to negative indicators of security differences is no justification to switch to NO indication. And it certainly doesn't help user understanding of any indicator to arbitrarily change it with 3 days of no meaningful discussion. The only thing that was insecure with Firefox EV has been that the original EV indicator only displayed the O= and C= field without enough context (ST, L). This was used to create tons of uninformed debate in order to later present that noise as "extensive discusison [SIC] in the security community about the usefulness of EV certificates". The change fixes nothing, but instead removes the direct indication of the validation strength (low-effort DV vs. EV) AND removes the one piece of essential context that was previously there (country). If something should be done, it would be to merge the requirements for EV and OV with an appropriate transition period to cause the distinction to disappear (so at least 2 years from new issuance policy). UI indication should continue to distinguish between properly validated OV and the mere "enable encryption with no real checks" DV certificates. On 12/08/2019 20:30, Wayne Thayer wrote:
Mozilla has announced that we plan to relocate the EV UI in Firefox 70, which is expected to be released on 22-October. Details below. If the before and after images are stripped from the email, you can view them here: Before: https://lh4.googleusercontent.com/pSX4OAbkPCu2mhBfeleKKe842DgW28-xAIlRjhtBlwFdTzNhtNE7R43nqBS1xifTuB0L8LO979yhpPpLUIOtDdfJd3UwBmdxFBl7eyX_JihYi7FqP-2LQ5xw4FFvQk2bEObdKQ9F After: https://lh5.googleusercontent.com/kL-WUskmTnKh4vepfU3cSID_ooTXNo9BvBOmIGR1RPvAN7PGkuPFLsSMdN0VOqsVb3sAjTsszn_3LjRf4Q8eoHtkrNWWmmxOo3jBRoEJV--XJndcXiCeTTAmE4MuEfGy8RdY_h5u - Wayne ---------- Forwarded message --------- From: Johann Hofmann <jhofm...@mozilla.com> Date: Mon, Aug 12, 2019 at 1:05 AM Subject: Intent to Ship: Move Extended Validation Information out of the URL bar To: Firefox Dev <firefox-...@mozilla.org> Cc: dev-platform <dev-platf...@lists.mozilla.org>, Wayne Thayer < wtha...@mozilla.com> In desktop Firefox 70, we intend to remove Extended Validation (EV) indicators from the identity block (the left hand side of the URL bar which is used to display security / privacy information). We will add additional EV information to the identity panel instead, effectively reducing the exposure of EV information to users while keeping it easily accessible. Before: After: The effectiveness of EV has been called into question numerous times over the last few years, there are serious doubts whether users notice the absence of positive security indicators and proof of concepts have been pitting EV against domains <https://www.typewritten.net/writer/ev-phishing/> for phishing. More recently, it has been shown <https://stripe.ian.sh/> that EV certificates with colliding entity names can be generated by choosing a different jurisdiction. 18 months have passed since then and no changes that address this problem have been identified. The Chrome team recently removed EV indicators from the URL bar in Canary and announced their intent to ship this change in Chrome 77 <https://groups.google.com/a/chromium.org/forum/#!topic/security-dev/h1bTcoTpfeI>. Safari is also no longer showing the EV entity name instead of the domain name in their URL bar, distinguishing EV only by the green color. Edge is also no longer showing the EV entity name in their URL bar. On our side a pref for this (security.identityblock.show_extended_validation) was added in bug 1572389 <https://bugzilla.mozilla.org/show_bug.cgi?id=1572389> (thanks :evilpie for working on it!). We're planning to flip this pref to false in bug 1572936 <https://bugzilla.mozilla.org/show_bug.cgi?id=1572936>. Please let us know if you have any questions or concerns, Wayne & Johann
Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
