New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 656843 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: iOS
Pri: 2
Type: Bug
Team-Security-UX

Blocking:
issue 673201



Sign in to add a comment

Update iOS Page Info to mention passwords and credit cards on HTTP pages

Project Member Reported by lgar...@chromium.org, Oct 18 2016

Issue description

See screenshots.
Individual string changes are easy; updating any of the structure is not.

I suggest we update at least the HTTP strings to mention passwords and credit cards in M56, so that our warnings for HTTP bad are consistent across platforms.

Adding the Hotlist-SecurityIndicators label because this is about consistency with those launches.
 
android.png
74.8 KB View Download
iOS.png
106 KB View Download
Summary: Update iOS and Android Page Info to mention passwords and credit cards on HTTP pages (was: Update iOS and Android Page Info to mention passwords and credit cards)
Components: UI>Browser>Omnibox>PageInfo
Components: UI>Browser>Omnibox>SecurityIndicators
Components: -UI>Browser>Omnibox>PageInfo UI>Browser>Bubbles>PageInfo
Labels: Hotlist-HttpBad
Cc: tsergeant@chromium.org
tsergeant, you did the Android part of this already, is that right?
Labels: -OS-Android
Summary: Update iOS and Page Info to mention passwords and credit cards on HTTP pages (was: Update iOS and Android Page Info to mention passwords and credit cards on HTTP pages)
Updating to only be about iOS.
Summary: Update iOS Page Info to mention passwords and credit cards on HTTP pages (was: Update iOS and Page Info to mention passwords and credit cards on HTTP pages)
Yes, see comment 14 on  issue 657148  for screenshots of the changes to Android.
Cc: maxwalker@chromium.org
Ideally we should release this with the iOS HTTP-bad release.

For that release, if we're in a time crunch, it's fine to just update the strings, without updating design (in terms of i.e. adding a colored title, or something)

Lucas, you mentioned there were iOS idiosyncracies that might be important for these strings. Can you give us a flavor of what you mean?
Labels: -Hotlist-PageInfo
Components: -Security>UX
Labels: -Hotlist-SecurityIndicators
Labels: -M-56 M-57
Owner: lgar...@chromium.org
Status: Assigned (was: Available)
lgarron can you take this for M57 to go along with the security indicator change you have in progress?
Yep, will do.
emilyschechter@: After talking with estark@, I've tried to make a minimal change [1] that *only* affects HTTP pages (including HTTP pages with password fields, which look just like HTTP pages in Page Info) and shows the strings for desktop.

This means:
- For HTTP (including HTTP with passwords), change the connection section to the HTTP summary and detail strings.
- Change the "What do these mean?" link to "Learn more "
- Show info icons for the identity and connection sections, for a) alignment with the "Learn more" link, and b) consistency with other WebsiteSettings-based Page Info surfaces.
- Do NOT add the subject (domain) at the top of the identity section.

This will leave a bunch of inconsistencies, which I would be free to address once this lands.

Sound okay?

[1] https://docs.google.com/document/d/1s5KzqmVRmWb_S8jnWMJx1N1egnk_53JxEH7CgaOE7ZA/edit#heading=h.8t64hxl1oynz
Screen Shot 2017-01-09 at 16.30.25.png
232 KB View Download
Screen Shot 2017-01-09 at 16.35.49.png
202 KB View Download
Actually, a more minimal change is to mention the site in the connection section for now.
Screen Shot 2017-01-09 at 16.47.05.png
233 KB View Download
Initial CL at crrev.com/2624653002
Project Member

Comment 19 by bugdroid1@chromium.org, Jan 17 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/86e86920236731fba6385c479cf27fd6c0d15655

commit 86e86920236731fba6385c479cf27fd6c0d15655
Author: lgarron <lgarron@chromium.org>
Date: Tue Jan 17 19:49:08 2017

iOS: Add the Page Info password/credit card string for HTTP pages.

This also updates the "What do these mean?" link to "Learn more" to match Desktop material design.

BUG= 656843 

Review-Url: https://codereview.chromium.org/2624963004
Cr-Commit-Position: refs/heads/master@{#444114}

[modify] https://crrev.com/86e86920236731fba6385c479cf27fd6c0d15655/ios/chrome/browser/ui/omnibox/page_info_model.cc
[modify] https://crrev.com/86e86920236731fba6385c479cf27fd6c0d15655/ios/chrome/browser/ui/omnibox/page_info_view_controller.mm

Status: Fixed (was: Assigned)
Screenshot from Canary on a real device.
IMG_4774.png
77.3 KB View Download
Project Member

Comment 21 by bugdroid1@chromium.org, Jan 20 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a6dd3781121d6a697d9d525e9d965f38c72b8df0

commit a6dd3781121d6a697d9d525e9d965f38c72b8df0
Author: lgarron <lgarron@chromium.org>
Date: Fri Jan 20 01:23:58 2017

Update Page Info on iOS to an interim Material Design state.

This brings it mostly in sync with other platforms by replacing two sections (identity info and connection info) with a single section containing a security summary and a sentence with details about what the security state means.

This CL also:
- Drops logic to show error strings related to and SHA-1 deprecation, since we don't detail this on desktop and some of these states can't even be detected on WKWebView anymore.
- Preserves the layout code for multiple sections, even if we only show a single one now.
- Preserves certificate information for devs/power users, since there is no other way to get the info until we have a certificate viewer on iOS (crbug.com/502470).

BUG= 680784 ,  656843 ,  640478 
TEST=Visit the following sites and check against the screenshots at  crbug.com/680784#c1  :
- expired.badssl.com (on iPhone)
- mixed.badssl.com (on iPhone)
- http-login.badssl.com (on iPhone)
- www.google.com (on iPhone)
- http.badssl.com (on iPad)

Review-Url: https://codereview.chromium.org/2620243005
Cr-Commit-Position: refs/heads/master@{#444919}

[modify] https://crrev.com/a6dd3781121d6a697d9d525e9d965f38c72b8df0/ios/chrome/browser/ui/omnibox/page_info_model.cc

Status: Assigned (was: Fixed)
All the URLs in comment #21 do match with the screen shots present in  crbug.com/680784#c1  except for http-login.badssl.com (on iPhone)

For the web page http-login.badssl.com (on iPhone) info icon "i"  is not displayed on iPhones.  Can you please confirm on this?

Note: For android devices http-login.badssl.com, do display info icon "i" on mobile phones.


IMG_0574.PNG
152 KB View Download
Addition to comment #22:  Checked on chrome canary version 58.0.2991.0
Status: fx (was: Assigned)
Sorry, that issue forgot to mention how to turn on the relevant flag:

1. Open the Settings app
2. Scroll to Chrome Beta/Dev/Canary and press
3. Scroll down to Experimental Settings and press
4. Scroll to EXTRA FLAGS (ONE PER LINE)
5. Toggle "Append Extra Flags" to ON
6. Set Flag1 to "--mark-non-secure-as=show-non-secure-passwords-cc-ui" (without the quotes)
Status: Fixed (was: Fx)
Blocking: 673201
Status: Verified (was: Fixed)
Verified in M57.0.2987.53 beta
Device: iPhone7, iPad Pro
iOS: 10.3, 10.1.1

info icon is displayed in omnibox for http sites with login forms.

Sign in to add a comment