3 ms·
I totally 100% agree with you but I'm not the average web user who will see a red lock icon with an X over it and think "these guys aren't running a secure site
by latortuga 14y ago
I totally 100% agree with you but I'm not the average web user who will see a red lock icon with an X over it and think "these guys aren't running a secure site". As web-savvy folks, sure, we know that it's a basic change and the security shortfall is minor (potentially not, though! there's a reason for mixed content warnings). You're average user has to be conditioned to even look for the lock or the https and seeing a big red X over it isn't doing anything for trustworthiness.
- simonbrown 14y agoThe security shortfall isn't minor. In Chrome (other browsers don't distinguish the severity), a crossed-out HTTPS means that a MITM attacker has the ability to run arbitrary javascript on the page. It doesn't even bother running severe mixed content now, though.