[tbb-bugs] #27636 [Applications/Tor Browser]: .onion indicator for non-self-signed but non-trusted sites

[Tor Bug Tracker & Wiki]

#27636: .onion indicator for non-self-signed but non-trusted sites
--------------------------------------+--------------------------
 Reporter:  o--                       |          Owner:  tbb-team
     Type:  defect                    |         Status:  new
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:  ux-team                   |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------

Comment (by o--):

 If I correctly understand the reasoning in #23247 a warning should be
 displayed if the certificate is "incorrect" (ie. wrong CN), which is the
 case in #13410. This might or might not be a good idea. Potentially it
 could indicate a misconfiguration on the server side (for example wrong
 virtual host).

 The case reported in this ticket however is a "correct" but untrusted
 certificate. In this case I really see no argument for treating it
 differently than "correct" but self-signed.

 But I agree that in general it is kind of difficult to define when the
 user should be warned, even though the onion address provides the end-to-
 end verified connection.

 In both of those tickets it seems to me, that requiring the service
 providers to "downgrade" to a self-signed certificate to get the green
 connection without UI hassle is a step back. In this ticket the service
 uses a custom CA which some users might already trust. In the #13410 the
 site provides a certificate for the identical non-onion site (which is
 correct and trusted). Both options feel like they are at least not worse
 than a self-signed cert.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/27636#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online