2 ms·
The insecure content may have been modified by a third party in transit. If that insecure content is javascript, it can directly change the behaviour of the pa
by mooism2 16y ago
The insecure content may have been modified by a third party in transit.
If that insecure content is javascript, it can directly change the behaviour of the page, perhaps stealing confidential information contained within it.
Even if the attacker is only changing e.g. a photo, it can still ensure you see a very different page from the one the website intended to send you.
- pasbesoin 16y agoExactly. It also breaks an existing, established security paradigm. If you want your users to actually properly practice some level of secure browsing, you have to keep the paradigms consistent. You can't expect the average user to adjust what cues they are looking for every six months, on a rolling basis. (Placing "locked padlock" graphics onto HTTP delivered pages is a good example of an abuse of such a paradigm. If your form is delivered by HTTP, it's trivial for a MITM to change the destination of its submission; making the form's destination URL HTTPS accomplishes nothing with respect to such a scenario.)