[Adblock Browser for iOS] add visible Indication of a secure connection

[Shikitita]

Background

Modern Browser indicate the use of secure and validated SSL connections and certificates by showing a lock sign (and sometimes the URL) in different colors. Since users got used to this, it's wise to also include this indicator to Adblock Browser.

There are 4 different certificates and certificate states, which should each be visualized in a different way:

1. No certificate present

2. Malicious certificate present (e.g. wrong domain or wrong subdomain)

3. Self-signed certificate present

4. Signed certificate or signed EV certificate present

What to change

For each type of certificate as described in the background section, implement the visualization as outlined below:

1. No visualization of a secured connection whatsoever. No changes to be implemented.

2. Display a broken padlock in front of the URL as displayed in this screenshot. Every time a website with this state of certificate is visited show a notification as currently implemented in Kitt.

Color to be used for the URL: # da001b
Text of the notification headline: Warning
Text of the notification: The site's security certificate is not trusted. Do you want to proceed?
Text of the cancel-button: Cancel
Text of the proceed-button: Proceed

Tapping "Cancel" will close the notification and stop loading the requested website (thus staying at the currently opened website or - of no website was opened - at the dashboard).
Tapping "Proceed" will close the notification and load the requested website.

3. Display a broken padlock in front of the URL as displayed in this screenshot. Every time a website with this state of certificate is visited show a notification as currently implemented in Kitt.

Color to be used for the URL: # da001b
Text of the notification headline: Warning
Text of the notification: The site's security certificate is not trusted. Do you want to proceed?
Text of the cancel-button: Cancel
Text of the proceed-button: Proceed

Tapping "Cancel" will close the notification and stop loading the requested website (thus staying at the currently opened website or - of no website was opened - at the dashboard).
Tapping "Proceed" will close the notification and load the requested website.

4. Display a padlock in front of the URL as displayed in this screenshot.

• Styleguide

Note to testers

The cert state recognition was not as much demanding as was keeping up with the aggresive iOS status caching of already once visited SSL sites. So the correct SSL status displayed on first load is not as critical as is a reproducible correct status when an already created browsing history with mixed type cert sites is navigated either through back/fwd or clicking history records.

Examples of test sites

1. No cert: any plain http site
2. Malicious cert: ​https://kitt.co/
3. Self-signed cert: ​https://www.cacert.org/
4. EV cert: twitter.com, square.com, ...

[philll]

How is this a bug? It's just a not implemented feature.

[Shikitita]

Yeah, sorry. Out of habit.

[pavelz]

EV: initial dev info gathering
​https://developer.apple.com/library/ios/technotes/tn2232/_index.html
SecTrustCopyResult
​http://opensource.apple.com/source/Security/Security-55471/sec/Security/SecTrust.h
​https://support.apple.com/en-us/HT205205
mind the EV policy column

Supplemental pseudo algorithm
​https://unmitigatedrisk.com/?p=203

[mario]

I've modified the description to reflect the fact, that we can't differentiate between signed certificates and EV certificates: Both certificate types are visualized the same.

[greiner]

Replying to mario:

I've modified the description to reflect the fact, that we can't differentiate between signed certificates and EV certificates: Both certificate types are visualized the same.

Any idea why we can't differentiate between those? If it's simply too much effort, I'd suggest creating a follow-up ticket for that.

[pavelz]

Unfortunate wording - there is no "can't" in the requirement. It's just too much effort for being considered a simple task. If it's being removed from the scope of this ticket, i would expect a new one, yes. When creating a new one, please move over my tech notes in https://issues.adblockplus.org/ticket/3203#comment:6

[mario]

I was under the impression, this was limited by iOS.
Created a follow up issue: #3284

[pavelz]

​https://www.pivotaltracker.com/story/show/105579096

[mario]

Batch modify: Added "-next" milestone to recently closed ABB/iOS issues.

[philll]

What shall happen if the proceed or cancel button is pressed?
Also, the background section stated "There are 5 different certificates and certificate states," while only four get mentioned afterwards.

[mario]

There are only 4 states. This was an error.
Changed the description and added the missing information.

[pavelz]

@mario What should happen with issue now? Will @philll reread the description and close?

[pavelz]

And it's not "ready" anyway

[scheer]

• 1. No change is displayed in normal websites without a certificate and plain text is displayed.

• 2. Malicious certificate sites such as ​​https://kitt.co/ display a warning message stating 'Warning - The site's security certificate is not trusted. Do you want to proceed? - 'Cancel' -'Proceed. Upon selecting 'Cancel' the user is presented with the page he was currently already viewing, or the Dashboard (dependant on the state before entering the address). Upon selecting 'Proceed' the page is loaded and a broken padlock is presented in the address bar and the address text changed from black to Red (# da001b)

• 3. Self-signed certificate sites such as ​​https://www.cacert.org/ display a warning message stating 'Warning - The site's security certificate is not trusted. Do you want to proceed? - 'Cancel' -'Proceed. Upon selecting 'Cancel' the user is presented with the page he was currently already viewing, or the Dashboard (dependant on the state before entering the address). Upon selecting 'Proceed' the page is loaded and a broken padlock is presented in the address bar and the address text changed from black to Red (# da001b)

• 4. EV certificate sites such as twitter.com and paypal.com are loaded and a green (# 36aa46) padlock is displayed in the address bar and the address text is also changed from black to green (# 36aa46). Please note that the above states that only a complete padlock should be displayed, but not with green (# 36aa46), but I am now referring to the completed issue that already changes EV Certificates located here - #3284

With regards to -

'The cert state recognition was not as much demanding as was keeping up with the aggressive iOS status caching of already once visited SSL sites. So the correct SSL status displayed on the first load is not as critical as is a reproducible correct status when an already created browsing history with mixed type cert sites is navigated either through back/fwd or clicking history records.'

As well as checking the first load of the above-mentioned sites, I also loaded through each type multiple times, to confirm that the website states changed back to the correct ones in each website certificate type.

ABB 1.3.0-qa (824)
iPhone 6 Plus - iOS 9.2.1