search

status-im / status-mobile

a free (libre) open source, mobile OS for Ethereum
https://status.app
Mozilla Public License 2.0
3.91k stars 984 forks source link

Security warning for browser view #4298

Closed rachelhamlin closed 6 years ago

rachelhamlin commented 6 years ago

User Story

As a user, I want to know when I am exposed to security risks in Status browser.

Description

Type: Feature

Summary:

Display some form of notification that when viewing user-entered URLs, the security of the page can not be proven because there are no HTTPS certificate details.

Expected behavior

When a user navigates to a URL in the browser bar or opens a link from chat, they receive some message or notification about the security risk.

e.g. "Be careful! Security details are not available. You may be at risk of phishing attacks."

This is an interim measure until more security details can be provided, in line with modern standards.

screen shot 2018-05-16 at 13 15 30

Actual behavior

Users can see only the URL in the browser bar, with no further security detail or risk notice.

denis-sharypin commented 6 years ago

ios_browser-website

We trigger this notification with every opening of the browser

  1. from the dapps list though address input
  2. from any link in the chat
  3. from the home tab

If a user closes this notification it disappears only for this browser session

Mockup here — https://zpl.io/2y7goew

Zeplin
Zeplin - Login
Collaboration app for UI designers and frontend developers
rachelhamlin commented 6 years ago

@denis-sharypin @flexsurfer this is not as urgent as we thought. Chrome is the only browser that displays full certificate details on mobile.

Can we alter the copy to say, "Connection is not proven secure. Make sure you trust this site before signing transactions or entering personal data."

It would be great if, in the near future, we could add a security symbol in the URL bar next to the address, which the user could click on to trigger this security warning.