Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

Please visit https://devforums.apple.com

If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show.

Does this necessarily mean that this login page is insecure?

However, https://itunesconnect.apple.com shows as being secure, according to Safari 6.

So the question is: How can I know whether a particular https site is secure, when it doesn't show the normal security mark?

share|improve this question

3 Answers

up vote 11 down vote accepted

Certain elements of the page are not sent via HTTPS. This means that those elements can be read by anyone sniffing the network, or modified in-transit by an active attacker. This might result in an attacker executing JavaScript on the page. As such, your browser is warning you that the page is, for most intents and purposes, the equivalent of not being encrypted at all.

share|improve this answer
Although in this case the elements are just images, so it's not quite as severe as executing JavaScript. There are still potential attacks you can do with misleading image files in general, so the browser must still warn about it. – bobince Aug 22 '12 at 7:00
@bobince I see some CSS being cached by Akamai too, which would allow complete page transformations, and execution of JavaScript on certain browsers. – Polynomial Aug 22 '12 at 7:23
interesting, I'm not seeing that - on the login page at least - only style02.css is fetched, from HTTPS. If there is non-HTTPS CSS, that is indeed a worse/XSS risk. – bobince Aug 22 '12 at 11:18
I'd like a good UI to indicate which webpage parts have been downloaded over HTTP. – curiousguy Aug 23 '12 at 1:14
1  
@curiousguy File a feature request in your favourite browser's bug tracker system then! I'd certianly second it. :) – Polynomial Aug 23 '12 at 5:52
up vote 3 down vote

If you take a look at the page source (e.g. through Chrome's fine 'inspect element' tool), you can see that the style sheet for the page specifies certain image elements.

EDIT: bobince is correct, my apologies. The problem is indeed that some of the images are served through http:

background:url(http://devimages.apple.com/global/elements/layout/forums/apple.gif)

Therefore those image elements aren't secure. This results in the warning about unsecure resources on an HTTPS page.

share|improve this answer
1  
You don't get a warning for having HTTPS-protected resources from different servers on the same page, only when there are resources from HTTP or improper HTTPS (eg expired cert). It's very common to include resources from a third-party HTTPS site. The warnings are appearing because the Akamaised images on devimages.apple.com are server through plain HTTP. – bobince Aug 22 '12 at 6:58
@Bobince Derp. Thanks. – Mark Beadles Aug 22 '12 at 11:31
up vote 0 down vote

It is a good practice to have the entire content on a website be protected through SSL. In the case you have mentioned the following have occurred:

  1. The SSL connection handshake have gone successfully with the browser and server. The negotiations and certificate validations are performed as required.
  2. It is ensured to the user that he is browsing the page hosted by the party it is meant to be.
  3. Not all contents which are visible in the page are from the URL. There are some links in the HTML code which points to some other servers (or same server linking to static reference in different context) in internet from where data like images or text are fetched and displayed.
  4. The important thing is that the user name and password you are going to type shall be sent to the server in SSL session only and in enciphered format which is very important.

As I said earlier, it is not the best practice, to increase the faith and confidence of the user, it is recommended to have all data displayed in the page to be loaded from the same server using the SSL session.

The draw back is SSL puts overhead to the data which is not desired for static images and text which are not of much importance. It depends on the business requirement. If millions of people are hitting the page everyday than it shall matter to the business in terms of the bandwidth used by the servers. Typically Banking sites will never follow the approach of partial data in SSL and some in non SSL as it can severely impact the user response.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.