3 ms·
What you're describing is known as a mixed-content vulnerability, which allows an appropriately positioned third-party to replace the content with whatever they
by justinschuh 15y ago
What you're describing is known as a mixed-content vulnerability, which allows an appropriately positioned third-party to replace the content with whatever they chose. In the case of something like an included JavaScript file, you're negating most of the security provided by SSL.
See: http://googleonlinesecurity.blogspot.com/2011/06/trying-to-end-mixed-scripting.html http://googleonlinesecurity.blogspot.com/2011/06/trying-to-e...
- elubow 15y agoRight. I think the goal of all this is to have everyone be on SSL so there aren't any mixed-content vulnerabilities. Hardware has come far enough where SSL is no longer overly taxing to encrypt-decrypt streams between the user and the site. So SSL-enabling a site isn't problematic (and in my opinion should be encouraged). (Full disclosure: I wrote that article).