[wpkops] Taxonomy of Browser Behaviors - "Hard Fail", "Soft Fail" and "Reload Request"

["Ben Wilson" <[e-mail]>]

In working on the next version of the Certificate Processing document, I
have come across two different uses of "hard fail."   I am also concerned
that use of the phrase, "soft fail," might encounter similar problems.  Also
I've seen "Retry" or "Reload" messages,  which are hard fail, but with an
option to try loading again. 

 

I've seen "hard fail" used (1) when referring to a session that is stopped
because of certificate revocation, where the user is prevented from
proceeding, and also (2) when referring to intentional client behavior when
encountering other problems with the certificate that indicate it is not
trustworthy.  (I suppose it could also mean a crash or other unintentional
behavior because of a bug in code.)  With respect to (2), I have called this
a "fatal error" - A behavior in which the browser detects an abnormal
condition and halts (or technically cannot complete) session negotiation and
drops the connection or otherwise blocks the user from continuing (also
referred to as "hard fail")."  However, in Phill's paper on revocation
behavior, he uses "hard fail", too.  

 

I have used the term "bypassable error" instead of "soft fail", defined as
"behavior in which the browser detects an abnormal condition and asks the
user whether to proceed with (i.e. click-through to) the SSL/TLS
connection."  Is this the same as "soft fail"?  (I'm assuming that a
negative visual indicator or a "downgrade" of security indicators like
removal of the lock icon, removal of EV indication, etc., are not "soft
fail."  I hope that everyone agrees.)  

 

Any thoughts?  Does it matter what kind of "next step" is provided in the
dialogue presented to the user?  For instance, the distinction between hard
and soft fail might be as simple as whether the error window lacks or
contains buttons or links that allow the user to proceed toward making the
SSL/TLS connection.  

 

For "hard fail," here is what I've seen:

 

[Error Message]

Firefox - "Fix connection problems" 

Opera - "This webpage is not available"

Chrome - "This webpage is not available"

Internet Explorer - "IE cannot display the webpage"  "What you can try:
Diagnose Connection Problems"

Internet Explorer - "This page cannot be displayed.  Fix connection
problems"

 

In looking at soft fail / bypassable errors,  here are some of the buttons
provided for a variety of different conditions, such as invalid
certificates:

 

[Error Message]

 

Firefox - "Get me out of here" "Technical Details" "I understand the risks"

Safari - "Show Certificate" "Cancel" "Continue"

Internet Explorer - "Click here to close" ""Continue to this website (not
recommended)" "More Information"

Chrome - "Proceed anyway" or  "Back to safety"  and "Help me understand"

 

Opera - "Show Certificate"  "Continue Anyway" and "Cancel" or "Back to
Safety"

 

A third option I've noticed is a "reload request", which I think is
different than a bypassable error or hard fail.  Am I right?

 

Here are some messages:

 

Chrome - "More" or  "Reload"

Firefox - "Try again"

 

Thanks,

Ben