15 ms·
Comodo not really getting the concept of HTTPS
- andygambles 13y agoSo while loading the seal over standard http is not a security issue in itself there is the problem of mixed content when loaded over https. This could leave the site open to a MiTM style attack since security fatigue means the user just loads insecure content. The http request could then potentially be redirected to load an alternative content.
- kdecherf 13y agoNote: Firefox 23 (currently active in Nightly) will block insecure content by default
- andygambles 13y agoimages are classed as passive content by Firefox 23 so by default they will load just the padlock will not show. More info: https://blog.servertastic.com/firefox-23-to-block-mixed-content/ https://blog.servertastic.com/firefox-23-to-block-mixed-cont...
- kdecherf 13y agoHm, good to know
- firloop 13y agoEven though the embed code has HTTP for the image url, it's still possible to load the images over SSL. https://www.positivessl.com/images-new/PossitiveSSL_tl_trans.gif https://www.positivessl.com/images-new/PossitiveSSL_tl_trans...
- andygambles 13y agoWhich makes it even more stupid that they haven't put this as the source code.
- davidddavidson 13y agoRelated: http://www.troyhunt.com/2013/05/why-i-am-worlds-greatest-lover-and.html http://www.troyhunt.com/2013/05/why-i-am-worlds-greatest-lov... (hn discussion: http://news.ycombinator.com/item?id=5661806 http://news.ycombinator.com/item?id=5661806) Looks like Troy picked up the Comodo story and demonstrates a MiTM attack here: http://www.troyhunt.com/2013/05/heres-why-you-cant-trust-ssl-logos-on.html http://www.troyhunt.com/2013/05/heres-why-you-cant-trust-ssl...