3 ms·
A single HTTP request in an otherwise HTTPS page can compromise the privacy and integrity of a user's connection. SSL/TLS isn't just about checking all the boxe
by bjacobel 10y ago
A single HTTP request in an otherwise HTTPS page can compromise the privacy and integrity of a user's connection. SSL/TLS isn't just about checking all the boxes so Chrome will give you the prettier icon, there are real stakes for users.
- andrewmunsell 10y agoTo expand on this-- Imagine you have a website with a payment form on an HTTPS page, but you embed some external analytics script over HTTP. If your visitor's request is MITMed (e.g. they're in a coffee shop or some other insecure WiFi access point, etc), then an attacker can modify the script (that's over HTTP) to send these credit card details to the attacker's server. Once there's a single HTTP resource on the page, HTTPS means a whole lot less, hence the scary warnings.
- baybal2 10y ago>Once there's a single HTTP resource on the page, HTTPS means a whole lot less, hence the scary warnings. More like if there is a single line of 3rd party code.