53

I went to sign into a website today using Google Chrome and was presented with the following error:

enter image description here

Your connection to this site is not fully secure

Attackers might be able to see the images you're looking at on this site and trick you by modifying them

When I clicked the Details link It says the following

The site includes HTTP resources

I have never seen this warning before.

What does this warning mean in laymans terms and should I sign into the website with my username and password?

Extra:

Opening the same page in Microsoft Edge it claims the website is secure

Improve this question
4
  • yes, your username and password are safe. images can't hurt you like say, untrusted scripts.
    – dandavis
    Jan 10, 2017 at 16:49
  • 5
    There's a new blog post for the Security UI in Chrome from the from devs. Includes this UI bit.
    – StackzOfZtuff
    Jan 11, 2017 at 5:48
  • It's worth noting that Stack Exchange itself has had issues with this exact scenario. See "Better HTTPS support for Stack Exchange sites"
    – Stevoisiak
    Apr 27, 2017 at 15:52
  • You find more details under 'mixed content' it basically means there might be Stylesheets, Pictures or even worse scripts loaded without https protection (which can be used to modify them and therefore attack the rest of the page)
    – eckes
    Apr 27, 2017 at 21:53

9 Answers 9

Reset to default
63

In a nutshell, it is saying that while the core of the page is using https (secure) to get that information to your computer, that (secure) page references insecure elements (like pictures and possibly scripts).

Attackers can't directly change the original page, but they can change the insecure elements. If those are pictures, they can change the image. If those are scripts, they can change those, too. In that way, attackers could change what you see, even though the core page was 'secure'.

As Michael Kjörling points out in the comments, this also exposes some of your information in these requests - potentially cookies (if it is the same site / matches the cookie sites / the developer didn't specify secure only), referrers, etc, which will leak some information about what you are doing at the best case and at the worse may allow certain attacks.

This is bad practice on the part of the web developer - all elements should use secure transport.

You could (potentially) improve your own situation using a browser plugin that auto-updates all requests to http to https.

Improve this answer
10
  • 10
    "and possibly scripts" In this case, almost certainly not scripts. The warning message only mentions images, so I'm fairly certain it's only images which are being delivered over HTTP here.
    – Ajedi32
    Jan 10, 2017 at 16:07
  • 4
    @user1 If the insecure parts of the page includes scripts such as javascript the page is not secure. Those scripts can grab any inputs and send them to an external server without the original page can do anything about it.
    – AnotherGuy
    Jan 10, 2017 at 16:09
  • 5
    @user1 That's a much harder question which depends on a lot of things besides just whether the website is delivered over a secure connection. In terms of the connection itself though, yes it does sound like this page is reasonably secure. Just be aware, as the warning message says, that images you view on the site could potentially be spied on and/or modified by an attacker.
    – Ajedi32
    Jan 10, 2017 at 16:12
  • 5
    IMO this should also mention the fact that in the plain-text HTTP requests, the referrer can leak potentially sensitive information (at a reasonable minimum, which pages you are looking at) which is normally protected by HTTPS.
    – user
    Jan 10, 2017 at 22:18
  • 3
    Chrome by default blocks loading scripts over HTTP when the main page was loaded with HTTPS.
    – Hitechcomputergeek
    Jan 11, 2017 at 8:34
23

The warning means that certain passive elements of the page (passive elements are things like images, videos, audio, etc) have been loaded over an insecure connection. No active content, which is content that could access your username or password (primarily scripts, but also iframes), has been loaded over an insecure connection, so entering your password on that page is just as safe as if the warning message was not there.

There are two reasons that browsers warn you about passive mixed content. The obvious one is that an attacker could replace the insecure images with something else. The more subtle risk is that if an attacker can see what images are loaded on the page, they might be able to correlate that with the pages on the site that load those images, and use that to determine what page on the site you are viewing. In your case, that doesn't matter, but for some sites HTTPS is used partly to prevent an eavesdropper from determining which part of a site you are viewing.

If the page has been loaded over HTTPS, and there is mixed active content, which means it wouldn't be safe to enter your password, your browser will block the script automatically, so it isn't a risk. If you decide that you do want the script, it very prominently marks the site as being insecure.

Before loading the unsafe content:

Chrome mixed active content warning

After clicking "Load unsafe scripts":

Chrome with a Not Secure warning

Provided that the URL begins https:// and there are no prominent security warnings, it is safe to enter your password.

Improve this answer
6

It means the webpage is not showing all of its content on https protocol. It has some parts using http. Mixed content is not good and this generate the warning you are seeing on browsers because part of the content can be viewed in plain.

Maybe some external images loaded as <img src="http://somewhere.net"> or some javascript, css or whatever.

Microsoft Edge is too much confident I think. :)

Improve this answer
3

This means that though your data and (most) of the site's content was sent over an SSL tunnel, the site loaded images over an unencrypted tunnel. This is not a major problem in most cases, though it's one that the developer should definitely fix.

However - "Should I sign in..." - In most cases (and in yours) it is safe to sign in. Your data will still be sent over the encrypted tunnel.

What you need to understand here is - some resources (such as images or scripts) were loaded over HTTP, and that's the problem:

|HTTPS|------>|Most of the page|--->|Can't be edited by attacker|

|HTTP|------->|Some resource|--->|Can be edited by attacker|

Improve this answer
3

The site is loading mixed content, some content such as images and css will be loaded over an insecure channel while the main site content is served over HTTPS. This is often the case when style / images are pulled in from CDNs.

In theory, the insecure elements could be man in the middled and modified without your knowledge to serve malicious content.

Chrome does alert you to these kinds of issues more than other browser and it's good to be cautious. If you have a history of trusting this site and it is reputable it is probably safe to continue. If you have not seen this before for a site you trust, you may wish to advise the developers what has happened.

Remember this would need an active attacker to be monitoring your connection to be able to exploit this vulnerability.

Improve this answer
2
  • 4
    "need an active attacker to be monitoring your connection to be able to exploit" Not necessarily, depending on your threshold for exploitation. The HTTP Referer header (which is normally sent along with any requests for additional resources) would be going in the clear because it's HTTP not HTTPS, and can easily leak information (certainly which page you are looking at). Read BCP 188 = RFC 7258.
    – user
    Jan 10, 2017 at 22:16
  • @MichaelKjörling This is also probably part of the reason why IE isn't too strict - neither cookies nor Referer is leaked for mixed content. You could possibly still exploit such resources to misguide the user (say, by switching the appearance of the "Yes" and "No" buttons on a confirmation dialog), but it's secure as long as the resource isn't important. Of course, the browser has no idea whether it is important or not, so it's a choice between "stupid IE, doesn't show harmless content" and "stupid IE, allows mixed content" :D
    – Luaan
    Jan 12, 2017 at 12:38
3

If you don't see the padlock, you can check the reason on:

Why No Padlock?

This service allows query parameters and works also with e-commerce websites such as ShopSite, Magento, WooCommerce.

This helps me a lot, especially when diagnosing a website.

Improve this answer
2

Just to expand on the Internet Explorer / Edge side:

  • The site doesn't appear to be insecure on a glance, and the insecure content doesn't seem to be highlighted either
  • It does print a security error to the console ("HTTPS security is compromised by <url>")
  • You can configure them to always reject mixed content
  • Mixed active content is rejected entirely - no "website is insecure" warning, the insecure active content simply doesn't run.

So IE is fully aware of the implications, but most likely considers them non-critical - information isn't leaked over the boundary, and images aren't active content (though there might still be an attack vector, like with the old WMF vulnerability). This still means you can be served data that isn't reliable (or encrypted) - the reasoning is probably along the line of "if it were important, it would be over HTTPs; the site is probably just trying to save CPU on static content".

Can this still be used for exploits? Sure. For example, if your "yes" and "no" buttons are images transported over HTTP, an (MITM) attacker might switch them, so that you would confirm a dialog you wanted to reject. This might be especially problematic if the website allows URLs that ask for something like "Do you want to send all your money to Mr. Hacker?" But it's only a problem if the content itself is important - confidential, security critical and the like. And of course, the browser has no way of knowing whether a particular resource is important or not - only the developer does (and people make mistakes).

It might seem that issuing the warning is a good security measure, but that isn't necessarily the case. If you see the same warning on half of the pages you go to, it's going to lose its effect entirely - people will just learn to ignore it (just like the first time IE asked you whether you want to allow sending insecure content, you just checked "Don't ask me again" and allowed it, without even realizing it - it's the first thing IE asks you when you try to post form data of any kind over HTTP). So you're really chosing between two bads, as is usually the case with any untrivial design - in this case, a false negative versus a false positive.

Improve this answer
1

"Not fully secure" is also how Chrome describes websites that use encryption algorithms that are no longer considered entirely safe, but are too widespread to turn off entirely. Currently, the only such algorithm is SHA-1, and they plan to turn that one off this month (with the release of version 56), but it could come up again in the future.

Improve this answer
1

I think it's worth pointing out that Chrome will also give you this message if there's a form tag on your page with a non-secure action. Chrome just displayed this message to me:

Your connection to this site is not fully secure

Attackers might be able to see the images you're looking at on this site and trick you by modifying them.

This can point you in entirely the wrong direction if the problem is in fact a form with a non-secure action.

So, this is good:

<form action="https://www.example.com/whatever.php">

and this is bad:

<form action="http://www.example.com/whatever.php">

You haven't requested any content from http://www.example.com/whatever.php yet, but if your user submits the form, it won't be secure, hence Chrome's warning.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .