2

When I open Gmail or Google search and leave it opened for a while, I notice this yellow warning triangle, as in these photos:

However, when I refresh the page it returns to the usual green lock icon.

Why I'm losing my private connection to Google? I have up-to-date Mozilla Firefox, and my connection is through a proxy server.

Thanks.

  • Does this also happen in the Chrome browser? – StackzOfZtuff Nov 23 '15 at 8:41
  • yes, also it's up-to-date – Emadeddin Nov 23 '15 at 8:42
  • Please check out the answer provided by @StackzOfZtuff and let us know which resource is not secure. – TTT Nov 23 '15 at 16:50
  • Next time it happens, open the development tool (ctrl+shift i), and look at the console. It should tell you what insecure urls that chrome reacts upon. – Dog eat cat world Nov 24 '15 at 15:04
  • The error never happened again, I removed some Adds-on and told our network admin to check if there any problems on the proxy. – Emadeddin Nov 25 '15 at 7:24
9

Since it does not complain about a bad certificate it is probably not related to MITM attacks. And since the original google.com is usually not mixed content I doubt that this message is caused by google itself.

Therefore I suggest that it is an in-browser issue, like some browser extension injecting code into the page where the code tries to load external resources using http instead of https. Thus check out the extensions you use and see if the issues is resolved when switching off specific extensions.

If you are in a corporate environment or have a local anti-virus working as a proxy there might still MITM in the form of SSL interception which then changes the page. To find out look at the certificate chain.

Apart from AV there is other software which injects its own root CA into the system. A typical example is the infamous Superfish which came pre-installed with Lenovo-Systems and which "enhanced" the browsing experience by injecting advertisements.

  • We use a proxy but without an AV, many of our employees complain about viruses or redirecting websites even on a cleaned PC, is it possible that the proxy itself is infected ? – Emadeddin Nov 23 '15 at 8:46
  • @Emadeddin: might be, but might be also that your DNS setup is corrupted. See darkreading.com/attacks-breaches/…. Although it is very strange that your browser does not complain about invalid certificates then, but maybe the attacker managed to get to add a trusted root CA into the browser. – Steffen Ullrich Nov 23 '15 at 8:50
  • @Emadeddin: might also be Superfish or similar, see edit. – Steffen Ullrich Nov 23 '15 at 8:54
  • Due to many pop-ups advertisements, you might be right – Emadeddin Nov 23 '15 at 9:06
  • All of the cases you mention around SSL/TLS MITM attacks would not show errors. If a root CA is installed by an employer, Superfish, etc., then the user is not going to be seeing these HTTPS browser warnings. – AndrewF Oct 7 '16 at 1:06
0

Diagnose with Chrome-F12-Toolbar

Chrome should tell you exactly what resource is insecure if you use the F12-toolbar. This is what it outputs on the https://mixed.badssl.com/ demo site:

Screenshot of Google Chrome F12-toolbar used to diagnose https://mixed.badssl.com/

Disable Chrome extensions, try again.

Try running Chrome with --disable-extensions. See if it happens again. If not, take a hard look at your extensions.

  • 2
    So does Firefox. Press Ctrl+Shift+K in Firefox to go straight to the developer console. – Toothbrush Nov 23 '15 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.