1

I use HTTPS Everywhere extension for Firefox, and recently I've started witnessing Mixed Content warnings from time to time, apparently when there are images with http:// prefixes (in particular at SE sites, on pages with imgur-links). As I've learned, HTTPS Everywhere should deal exactly with those kind of things by changing prefixes to https.

I've also created a new profile to install only HTTPS Everywhere (to test 'some conflict between extensions' hypothesis), but it still gives the warning with similar circumstances.

What could be the problem and what should I do with it?

(software versions: Firefox 44.0.2; HTTPS-Everywhere 5.1.4)

(Originally I've posted this question on meta, but was suggested to ask this question here.)

1

HTTPS everywhere relies on a ruleset that determines which domains support HTTPS. The ruleset can be searched here, and I suspect if you search for the domains which host the insecure images they won't be there.

To some degree the problem you describe is expected, because if the site was fully compatible with HTTPS then presumably the website owner would send traffic to the HTTPS version without the need for HTTPS everywhere.

Despite this limitation, there is probably still value in using HTTPS everywhere. The most sensitive data is usually the page/document itself and the JavaScript so if they can be encrypted you'll receive most of the benefits of HTTPS.

  • That is the strangest part: there is a ruleset for imgur.com. And it is green-checked at extension button menu... And it still shows 'mixed content' warning. What should I make of this? – The_Keeper Feb 28 '16 at 2:59
  • When I visit imgur.com with HTTPS everywhere on Chrome it says all resources are secure. – thexacre Feb 28 '16 at 3:10
  • exactly.... imgur.com and its very same image links work perfectly with https on their own, but fail when they are on a stackexchange page... Try this one. Is it secure? – The_Keeper Feb 28 '16 at 3:17
  • or better try this one (confirmed that imgur ruleset green-checked and warning is still there) – The_Keeper Feb 28 '16 at 3:25
  • 1
    If you have a specific issue with a specific site maybe you should post an issue on the HTTPS everywhere github project so they can help you debug it. – thexacre Feb 28 '16 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.