Expand SecurityStyleChanged interfaces to include explanations

chrome/app/generated_resources.grd

Index: chrome/app/generated_resources.grd
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index fe443ddee450a151c633afefa5f6d7fe5a3e7df3..47fbe233c7f37058cb3fc047870dadc4b1aa14b2 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -15643,6 +15643,39 @@ After you create a new supervised user, you can manage their settings at any tim
           Your printer is ready.
         </message>
       </if>
+
+      <!-- Strings describing Chrome security policy for DevTools security panel -->
+      <message name="IDS_BROKEN_SHA1" desc="Summary phrase for a security problem where the site's certificate expires in 2017 or later and contains a SHA1 signature in the chain.">
+        SHA-1 Certificate
+      </message>
+      <message name="IDS_BROKEN_SHA1_DESCRIPTION" desc="Description of a security problem where the site's certificate expires in 2017 or later and contains a SHA1 signature in the chain.">
+        The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1.
+      </message>
+      <message name="IDS_WARNING_SHA1" desc="Summary phrase for a security problem where the site's certificate expires in 2016 and contains a SHA1 signature in the chain.">
+        SHA-1 Certificate
+      </message>
+      <message name="IDS_WARNING_SHA1_DESCRIPTION" desc="Description of a security problem where the site's certificate expires in 2016 and contains a SHA1 signature in the chain.">
+        The certificate for this site expires in 2016, and the certificate chain contains a certificate signed using SHA-1.
+      </message>
+      <message name="IDS_PASSIVE_MIXED_CONTENT" desc="Summary phrase of a security problem where the site displayed passive mixed content.">
+        Mixed Content
+      </message>
+      <message name="IDS_PASSIVE_MIXED_CONTENT_DESCRIPTION" desc="Description of a security problem where the site displayed passive mixed content.">
+        The site includes HTTP resources.
+      </message>
+      <message name="IDS_ACTIVE_MIXED_CONTENT" desc="Summary phrase for a security problem where site ran active mixed content.">
+        Mixed Content

[lgarron, 2015/06/18 01:28:45]

estark@: Would you mind changing this to "Mixed Scripts" (or "Active Mixed
Content")?

[Ryan Sleevi, 2015/06/18 01:34:03]

-1 scripts (can apply to other bits, such as ws:// connections)
+1 to Active Mixed Content

and with the bonus nitting that these have yet another (not _yet_ well
publicized) name of "Blockable Content" (
https://w3c.github.io/webappsec/specs/mixedcontent/#category-blockable )

[lgarron, 2015/06/18 01:47:25]

We only talk about "scripts" to end users [1]. I'm fine with "Active Mixed
Content", although then we should probably update
IDS_ACTIVE_MIXED_CONTENT_DESCRIPTION to mention other common active mixed
content (e.g. iframes).

[1] https://support.google.com/chrome/answer/1342714

[estark, 2015/06/18 18:52:23]

Changed to "Active Mixed Content" and "You have recently allowed insecure
content to run on this site" though I'm not thrilled with the latter since it
seems kind of vague/unhelpful.

Audience for these is developers, not end users, right? So we can be more
precise, if we want to -- though I'm not sure if it's a good idea to try to be
exhaustive.

(Also I think we will probably want to have ainslie@ look these over at some
point.)

[lgarron, 2015/06/18 20:22:46]

+1 on definitely running things by Alex before expanding a final sec of strings.

How about "You have recently allowed insecure content (e.g. scripts, iframes) to
run on this site"?

+      </message>
+      <message name="IDS_ACTIVE_MIXED_CONTENT_DESCRIPTION" desc="Description of a security problem where site ran active mixed content.">
+        You have recently allowed insecure scripts to run on this site.
+      </message>
+      <message name="IDS_CERTIFICATE_CHAIN_ERROR" desc="Summary phrase for a security problem with the site's certificate.">
+        Certificate Error
+      </message>
+      <message name="IDS_CERTIFICATE_CHAIN_ERROR_DESCRIPTION_FORMAT" desc="Description of a security problem with the site's certificate.">
+        There are issues with the site's certificate chain (<ph name="CERT_ERROR_DESCRIPTION">$1<ex>net::ERR_CERT_AUTHORITY_INVALID</ex></ph>).
+      </message>
+
     </messages>
   </release>
 </grit>