4 ms·

Google Chrome 6 is zealous about mixed encrypted/clear pages

• pasbesoin 16y ago
  I don't know any more than the image, but based on this, I say: Good! I'm more than tired of this type of broken security. I'm interested to see how Google's own sites fare. I've not that infrequently had to put up with the "broken lock" when e.g. Gmail or Apps decides to deliver some of the page content via http.
  • deleted 16y ago
    [deleted]
  • leoc 16y ago
    I'm no expert on security, but I don't really see how mixed content merits a warning, let alone one so melodramatic. As far as I can see it doesn't widen the number of people you have to trust: the content loaded is under the control of the webserver whose URI is in the address bar, and that server has the power to betray the confidence of your time on that page in arbitrary ways anyhow.
    • mooism2 16y ago
      The insecure content may have been modified by a third party in transit. If that insecure content is javascript, it can directly change the behaviour of the page, perhaps stealing confidential information contained within it. Even if the attacker is only changing e.g. a photo, it can still ensure you see a very different page from the one the website intended to send you.
      • pasbesoin 16y ago
        Exactly. It also breaks an existing, established security paradigm. If you want your users to actually properly practice some level of secure browsing, you have to keep the paradigms consistent. You can't expect the average user to adjust what cues they are looking for every six months, on a rolling basis. (Placing "locked padlock" graphics onto HTTP delivered pages is a good example of an abuse of such a paradigm. If your form is delivered by HTTP, it's trivial for a MITM to change the destination of its submission; making the form's destination URL HTTPS accomplishes nothing with respect to such a scenario.)