Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site?

https://www.microsoft.com/en-us/default.aspx

Missing lock icon

I am able to see the lock icon on Facebook and any other site.

With lock

share|improve this question
    
Accessing Facebook from a server OS? I sense a disturbance, as if a thousand InfoSec engineers cried out in terror... –  Graham Hill Jan 6 '13 at 17:23
    
@GrahamHill haha, I would never use FB on a production server. I'm using Server 2012 as a local development OS –  makerofthings7 Feb 8 '13 at 0:13

1 Answer 1

up vote 3 down vote accepted

It's because the connection is not actually secure: There is an HTTPS error on the page about mixed content. Some data is loaded over HTTP (and not HTTPS), which causes this error. You can see this if you open the page in another browser like Chrome.

Edit: Some more information about mixed content errors, from my answer on this question.

if one of the resources used by the website (such as an image or a script) is loaded over HTTP, the confidentiality cannot be guaranteed anymore. Even though browsers do not send the HTTP Referer header when requesting non-secure resources from a secure page (source), it is still possible for someone eavesdropping on traffic to guess where you're visiting from; for example, if they know images X, Y, and Z are used on one page, they can guess you are visiting that page when they see your browser request those three images at once. Additionally, when loading Javascript, the entire page can be compromised. An attacker can execute any script on the page, modifying for example to whom the bank transaction will go.

When this happens (a resource being loaded over HTTP), the browser gives a mixed-content warning: Chrome, Firefox, Internet Explorer 9

share|improve this answer
    
Firefox also reports the error, and will not show the padlock icon for the Microsoft site. –  Thomas Pornin Jan 5 '13 at 21:07
    
Interesting... Safari on Mac doesn't show any error at all –  makerofthings7 Jan 5 '13 at 21:35
    
@makerofthings7 You're surprised by that? ;) –  Steve Jan 5 '13 at 22:09
    
@SteveS I've always lived on IE and Chrome. Now I'm on a MacBook and learning Safari... amazing what the "other world" is like. I need my pop-ups that tell me something is wrong! –  makerofthings7 Jan 5 '13 at 22:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.