3 ms·
I'm no expert on security, but I don't really see how mixed content merits a warning, let alone one so melodramatic. As far as I can see it doesn't widen the nu
by leoc 16y ago
I'm no expert on security, but I don't really see how mixed content merits a warning, let alone one so melodramatic. As far as I can see it doesn't widen the number of people you have to trust: the content loaded is under the control of the webserver whose URI is in the address bar, and that server has the power to betray the confidence of your time on that page in arbitrary ways anyhow.
- mooism2 16y agoThe insecure content may have been modified by a third party in transit. If that insecure content is javascript, it can directly change the behaviour of the page, perhaps stealing confidential information contained within it. Even if the attacker is only changing e.g. a photo, it can still ensure you see a very different page from the one the website intended to send you.
- pasbesoin 16y agoExactly. It also breaks an existing, established security paradigm. If you want your users to actually properly practice some level of secure browsing, you have to keep the paradigms consistent. You can't expect the average user to adjust what cues they are looking for every six months, on a rolling basis. (Placing "locked padlock" graphics onto HTTP delivered pages is a good example of an abuse of such a paradigm. If your form is delivered by HTTP, it's trivial for a MITM to change the destination of its submission; making the form's destination URL HTTPS accomplishes nothing with respect to such a scenario.)