2

When I open Gmail or Google search and leave it opened for a while, I notice this yellow warning triangle, as in these photos:

However, when I refresh the page it returns to the usual green lock icon.

Why I'm losing my private connection to Google? I have up-to-date Mozilla Firefox, and my connection is through a proxy server.

Thanks.

5
  • Does this also happen in the Chrome browser? Nov 23, 2015 at 8:41
  • yes, also it's up-to-date
    – Eibo
    Nov 23, 2015 at 8:42
  • Please check out the answer provided by @StackzOfZtuff and let us know which resource is not secure.
    – TTT
    Nov 23, 2015 at 16:50
  • Next time it happens, open the development tool (ctrl+shift i), and look at the console. It should tell you what insecure urls that chrome reacts upon. Nov 24, 2015 at 15:04
  • The error never happened again, I removed some Adds-on and told our network admin to check if there any problems on the proxy.
    – Eibo
    Nov 25, 2015 at 7:24

3 Answers 3

8

Since it does not complain about a bad certificate it is probably not related to MITM attacks. And since the original google.com is usually not mixed content I doubt that this message is caused by google itself.

Therefore I suggest that it is an in-browser issue, like some browser extension injecting code into the page where the code tries to load external resources using http instead of https. Thus check out the extensions you use and see if the issues is resolved when switching off specific extensions.

If you are in a corporate environment or have a local anti-virus working as a proxy there might still MITM in the form of SSL interception which then changes the page. To find out look at the certificate chain.

Apart from AV there is other software which injects its own root CA into the system. A typical example is the infamous Superfish which came pre-installed with Lenovo-Systems and which "enhanced" the browsing experience by injecting advertisements.

5
  • We use a proxy but without an AV, many of our employees complain about viruses or redirecting websites even on a cleaned PC, is it possible that the proxy itself is infected ?
    – Eibo
    Nov 23, 2015 at 8:46
  • @Emadeddin: might be, but might be also that your DNS setup is corrupted. See darkreading.com/attacks-breaches/…. Although it is very strange that your browser does not complain about invalid certificates then, but maybe the attacker managed to get to add a trusted root CA into the browser. Nov 23, 2015 at 8:50
  • @Emadeddin: might also be Superfish or similar, see edit. Nov 23, 2015 at 8:54
  • Due to many pop-ups advertisements, you might be right
    – Eibo
    Nov 23, 2015 at 9:06
  • All of the cases you mention around SSL/TLS MITM attacks would not show errors. If a root CA is installed by an employer, Superfish, etc., then the user is not going to be seeing these HTTPS browser warnings.
    – AndrewF
    Oct 7, 2016 at 1:06
0

Diagnose with Chrome-F12-Toolbar

Chrome should tell you exactly what resource is insecure if you use the F12-toolbar. This is what it outputs on the https://mixed.badssl.com/ demo site:

Screenshot of Google Chrome F12-toolbar used to diagnose https://mixed.badssl.com/

Disable Chrome extensions, try again.

Try running Chrome with --disable-extensions. See if it happens again. If not, take a hard look at your extensions.

1
  • 2
    So does Firefox. Press Ctrl+Shift+K in Firefox to go straight to the developer console.
    – Toothbrush
    Nov 23, 2015 at 12:51
-1

I recently started getting the message: "Your connection to Google is not secure" recently from my chrome browser. If I manually typed in https://google.com then the issue went away.

I recently allowed the Adobe acrobat extension to become installed.

Removing the Adobe extension has fixed the issue.

Very fishy, Adobe..

4
  • Did you further analysis on the plugin in question? Have you analyzed its communication etc? Jun 8, 2022 at 17:30
  • Correlation does not imply causation. Until you can explain what actually was going on, this is just a guess. In fact, your answer should provide more than the accepted answer (the extension injecting code onto the page) else this is just a repeat of that answer.
    – schroeder
    Jun 8, 2022 at 18:50
  • I recently started getting that message from various browsers. It isn't Adobe's fault, Google has done something weird.
    – Chenmunka
    Jun 9, 2022 at 6:27
  • No further analysis except the exact same experience on a second PC.
    – Gord Wait
    Jun 9, 2022 at 19:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .