8 ms·
Firefox 23 will block non-SSL content on SSL pages by default
- nachteilig 14y agoThis doesn't mention images specifically -- anyone have insight into how that will work? I'm assuming they're not "active" content. Even Google's image search displays insecure images, so I'd hope they get a pass.
- simonster 14y agoIt looks like images get loaded. However, CSS doesn't, which breaks a lot of sites (e.g. https://www.nytimes.com/ https://www.nytimes.com/). This is in the latest Firefox Nightly build, and available as a pref in older Firefox versions, so you can play with it too.
- nthitz 14y agoJust visited secure NYT link on Chrome 26 and none of the CSS and few images loaded there either. Console reports loads of [blocked] insecure content.
- iaskwhy 14y agoSo that explains why some sites were looking unstyled. Github had the same problem some days ago.
- somesay 14y agoAgain, if you embed non-SSL content into a SSL website, you are obviously doing something wrong. Regex in CSS can be used to guess page content. Also CSS can load SVG which may include JavaScript.
- smackfu 14y agoIt's odd they have a secure version of nytimes.com at all. They have separate subdomains like myaccount.nytimes.com that are secure, and the links back to the homepage are all explicitly http.
- tspiteri 14y agoFrom the article: That means insecure scripts, stylesheets, plug-in contents, inline frames, Web fonts and WebSockets are blocked on secure pages, and a notification is displayed instead. That seems to me like a complete list and does not include images.
- overshard 14y agoIn other words, start using the `//url.to/something-here/` shortcut and the world will be a better place. EDIT: Use `//` instead of `http://` http://` or `https://` https://` and it will use whatever the protocol of the page being fetched is using. EDIT 2: Double check when you use the `//` shortcut that the website you are linking to supports HTTPS, some still don't and they don't redirect properly...
- thezilch 14y agosome still don't... Most still don't!
- dudus 14y agoIE7 and IE8 will download stylesheets that use protocol relative urls twice. http://stackoverflow.com/questions/4831741/can-i-change-all-my-http-links-to-just http://stackoverflow.com/questions/4831741/can-i-change-all-...
- deleted 14y ago[deleted]
- GauntletWizard 14y agoIf this is a concern, you've made some very poor decisions.
- AdamGibbins 14y agoChrome has been doing this a fair while now, not very well in my opinion either - the option to enable secure content is hidden away in a tiny silver shield at the right of the URL bar.
- gmurphy 14y agoThe visibility of the shield was designed to be proportional to the number of people who care/should care about it.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- somesay 14y agoIf you embed non-SSL content into a SSL website, you are obviously doing something wrong. Therefore the shield is already visible enough. Not giving this option at all would have been a valid attempt, too.
- smackfu 14y agoDo the affected pages currently show a warning in Firefox 22?
- cpeterso 14y agoFirefox 22 and earlier do not show a user-visible warning, but they do log bright red "[Mixed Content]" warnings in Firefox's Developer Console. Firefox 23 displays a grey shield icon in the address bar for mixed content.
- mehrzad 14y agoYep, I use FF Nightly and Pocket's bookmarklet, noticed that the bookmarklet broke in this new version, and notified Pocket Support.
- collinjackson 14y agoNote that both Chrome and IE have been blocking this for some time now. IE did it first.
- PixelPusher 14y agoYeah, Chrome has been doing this for a while. It has actually been pretty annoying that FireFox wasn't doing so. My main dev environment is FireFox and i hate it when things work for FF but not Chrome.
- brownbat 14y agoIE took a lead move in favor of security, kudos to them. It seems like Chrome really forced the ecosystem to move towards auto-updates and sandboxing. Each of those have transition impacts for developers and publishers. Mixed content though, I've got to imagine that's a hard area for Google to lead on, since its transition challenges primarily affect ad integration. This follows on the heels of the "disable third party cookies by default" row. I'm wondering if a) Google's business interests will prevent them from being a first mover on security and privacy in browser development, and b) if other browsers will start exploring these issues just to force Chrome to make hard choices.
- buro9 14y agoTo anyone now panicing about user generated content and non-SSL images, and thinking "What I need is some kind of SSL proxy for user generated images"... Node based SSL proxy: https://github.com/atmos/camo https://github.com/atmos/camo And I whipped one up in PHP for some old PHP site that I worked on if anyone wants to see that. I shoved that behind Nginx so that I also get a file cache for the most requested files. For my project I purchased an extra SSL domain name ( https://sslcache.se https://sslcache.se ), as I had some concern about serving user generated content on my primary domain. Concerns which are valid, as github.com recently acknowledged by moving their UGC pages to github.io .
- calebegg 14y agoAs far as I can tell, this change doesn't apply to images, and probably shouldn't apply to user-generated content (i.e., you shouldn't be letting users write/embed arbitrary CSS, JS, plugins, fonts, frames, etc...)
- buro9 14y agoI had read the link, and whilst it doesn't mention images as being included in the change it also doesn't mention images as being excluded, and does imply that all mixed content is blocked. It was my assumption given those conditions that it included images. And there are many scenarios in which you do want to allow user generated content to include JS, off the top of my head Google Maps does so to allow user maps to be extensible. The issue is how such content is managed safely, and enabling SSL and putting the content on another domain is a good thing. Google do the right thing and serve such content over SSL and via an iframe on a totally different domain ( http://whois.domaintools.com/googleusercontent.com http://whois.domaintools.com/googleusercontent.com ).
- stock_toaster 14y agoFWIW I too wrote a camo clone, but in Go[1]. Decently sized project for learning a new language. At $dayjob we have a python version too (considering replacing it with the Go version at some point)... [1]: https://github.com/cactus/go-camo https://github.com/cactus/go-camo
- jrochkind1 14y agoI believe this has been default on IE (and maybe even Chrome?) for quite some time.
- derefr 14y agoIt's fun looking at unintended tack-on effects of decisions like this. For example, requiring SSL for all assets served on SSL pages is going to make the profits of CloudFlare, and other CDN providers with their same business model, spike precipitously. You have to have a paying plan ($20/mo to start) to get SSL CDNing support, which basically means CloudFlare's free plan is now useless to anyone who enforces HSTS.
- somesay 14y agoA lot of companies make profit by selling SSL as an pro feature. Just look at all those services where SSL login is only available at a certain cost level. (And using SSL only for the login form is a joke, too.) It's a shame that these are making money from that basic consumer security. Especially since SSL is neither expensive nor need a lot of performance.
- dan_manges 14y agoI would expect most companies serving pages over SSL to already be serving assets over SSL to avoid the mixed content warnings that most browsers currently give when loading non-SSL assets on an SSL page.
- acdha 14y agoIf you care about security enough to use HTTPS, you need to serve assets over SSL anyway. Note that this does not affect all assets – only active content – which means that you can still serve images, audio, video, etc. over HTTP if you're comfortable with the risk of interception, spoofing, etc.
- hexis 14y agoI wonder if this will help push Google to start serving AdSense over SSL?
- jastanton 14y agoits been a while since I made a Facebook App but I am pretty sure last time I checked you can made an app on a non-SSL domain and it will be iframed into the secure page, which in FF23 will break, so some apps may not work anymore. just saying.
- babuskov 14y agoIf you access the app using https-ed Facebook, i.e. via https://apps.facebook.com/appname https://apps.facebook.com/appname, it would use https:// https:// for the iframe as well. So, no problems there (at least no new ones that did not already exist).
- Karunamon 14y agoCan you click a button in the notice to override the error and display the content anyways? If not, this is going to be a colossal pain in the ass.
- kbrosnan 14y agoYes the current implementation works similar to click to play plugins. A shield icon shows up in the address bar as well as a notice that the domain has http:// http:// content. (in more user friendly terms) Examples of the click to play UI at https://blog.mozilla.org/security/2012/10/11/click-to-play-plugins-blocklist-style/ https://blog.mozilla.org/security/2012/10/11/click-to-play-p...
- filereaper 14y agoDoes Firefox 23 have support for TLSv1.2? Please fix NSS and support TLSv1.2 As of now only IE and Opera are the ones which I'm aware of that support TLSv1.2. There is a vulnerability for BEAST against SSL 3.0/TLSv1.0 With more widespread use of HTTPS which isn't a bad thing, it would help that all browsers support the latest security recommendations. https://blogs.akamai.com/2012/05/what-you-need-to-know-about-beast.html https://blogs.akamai.com/2012/05/what-you-need-to-know-about...
- KNoureen 14y agoFirefox 23 does not have TLS v1.2, but Nightly will very soon. During March there have been very active development in NSS for TLS v1.2 and they are AFAIK checking in bit by bit now.
- ctz 14y agoThere's no point implementing TLS1.2 until browsers stop silently downgrading through TLS versions under attacker control. And there's not much prospect of that happening: it seems we're happy to exchange compatibility with less than 1% of sites for security of 100%.
- peterwwillis 14y agoFrom what i've read, it looks like the server advertises all the TLS it supports, the client picks the highest version, but then an attacker sends an RST and the client goes to the next version in the list. Is that accurate? (The only other downgrade attack I saw was on False Start which has since been disabled in Chrome) Could (or should) they support an option in the browser to require only the highest possible version of a protocol? Or is there some other fix required to mitigate the attack?
- pronoiac 14y agoWould Google Reader get an exception, or is this Firefox version being released after that shuts down?
- Skalman 14y agoFirefox 23 will be released on August 6 [1], while Reader closes on July 1 [2]. [1] https://en.wikipedia.org/wiki/History_of_Firefox#Version_23 https://en.wikipedia.org/wiki/History_of_Firefox#Version_23 [2] https://en.wikipedia.org/wiki/Google_Reader https://en.wikipedia.org/wiki/Google_Reader
- Kiro 14y agoI was considering upgrading my site to HTTPS but now I changed my mind. The benefits are no big deal anyway.
- jscheel 14y agoBrowsers blocking insecure content has been a challenge for us. Users can add embeds into their pages, unfortunately, no two embeds are alike. There are way too many services that don't offer secure versions of their embeds, and on top of that, several implement secure vs insecure embeds differently.