3

In Google Chrome, when I go to an encrypted page that contains unencrypted content, I get the following pop-down, which allows me to either load or not load the insecure content, making a clear recommendation to not load it:

enter image description here

Here, the user is clearly notified that there is a problem and is even provided with a way to stay safe by not loading the insecure content.

In Firefox, when I go to the same page, I receive the following popup dialog, however the page then proceeds to load the insecure content anyway:

You have requested an encrypted page that contains some unencrypted information.

However, the above checkbox by default is left unchecked, so most users will only see this once.

In addition, both Opera and Konqueror continue to load the unencrypted content as well. In both of these browsers, the address bar remains white (the same as visiting a normal page), however neither of these browsers even give any further indication to the user that there is a problem with the site unless you manually click to view the certificate details or happen to notice the address bar change (or not change) color.

So my question is, if the unencrypted content is loaded isn't the damage already done? I know this is more a matter of opinion, but why would other browsers not provide a way to prevent this content from being loaded completely? Doesn't this add to security?

Edit: Doing a bit more searching I came across these Mozilla bugs related to this:

So I'm assuming that the reason this is not implemented (at least in the case of Firefox) is because it is a difficult bug to fix, but they are working on it.

Improve this question
1
  • So do you object to HTTPS headers (or JS code) setting a non-secure cookie? If so, do you object to non-secure cookies being sent for HTTPS requests?
    – curiousguy
    Commented Jul 1, 2012 at 4:54

2 Answers 2

Reset to default
4

Maybe it's best to explain the problem with mixed content.

A lot of websites will store the login state into the session, and if an attacker has the session-id, he can impersonate the logged in user. The session-id must be sent along with each request, so the server can recognize the user, this will usually be done with a cookie containing the session-id.

If a site uses HTTP mixed with HTTPS, the session-id would be transmitted plaintext for all HTTP requests by default (even for image requests). So if the attacker can read a single HTTP request after the user has logged in, he knows the session id.

To answer your question, you should not load mixed content, as long as you are concerned with privacy. It depends of the implementation of the site, if an attacker can get your session-id then. If the browser asks whether to load the mixed content, you have a chance to avoid this situation.

Improve this answer
11
  • What's the threat model here?
    – curiousguy
    Commented Jul 1, 2012 at 10:35
  • @curiousguy - 1) The user logs in with HTTPS. 2) The attacker makes a man in the middle attack. 3) The user loads a page with mixed content. 4) The attacker can read the session-id from the HTTP request. 5) The attacker can use this session-id to impersonate the user, even with HTTPS requests.
    – martinstoeckli
    Commented Jul 1, 2012 at 11:29
  • In practice it may not matter that much that the page has mixed content; the user probably has some other HTTP web page open in his browser, if you can MITM the mixed-content site, you can MITM some random HTTP site.
    – curiousguy
    Commented Jul 1, 2012 at 11:42
  • @curiousguy - Cookies are sent only to the domain, they originate from. A session cookie from the domain example.com would not be sent to randomsite.com.
    – martinstoeckli
    Commented Jul 1, 2012 at 13:33
  • 1
    "Cookies are sent only to the domain, they originate from." Yes. "A session cookie from the domain example.com would not be sent to randomsite.com" randomsite.com only needs to add one <img src="http://example.com/"> (a redirect will work too), and the browser will send the cookies in cleartext
    – curiousguy
    Commented Jul 1, 2012 at 13:47
4

Yes, it does add to security and yes it should be done but security is often neglected over usability.

For example the Chrome notification is barely even present as opposed to the firefox popup. More importantly, to actually prevent such a threat the browser must not only notify the average user (who would have no idea what's doing on) but also give the option to load or not load unsecure content in a manner where he understands that there are risks involved.

In such a case, the browser requires the technology to prevent HTTP content from loading and allowing HTTPS to load. This as you know can have several effects on the page. As time passes I'm sure other browsers will developer similar technology to be able to isolate HTTP and HTTPS content and then give the user an option to load or block it each time they encounter such a page.

As far as security is concerned about mixed content in technicality, it really depends on what is going through. A good example is going to a company's website doesn't require open public knowledge to be loaded in HTTPS, but your log in does.

Ultimately its is the question of user privacy, wherein HTTPS triumphs, but the average user is unaware of this, and websites do not want the extra effort to make the entire thing HTTPS.

Firefox Similar Bug Report: https://bugzilla.mozilla.org/show_bug.cgi?id=251123

Improve this answer
5
  • 1
    "security is often neglected over usability" when you don't have usability, you don't have security, period.
    – curiousguy
    Commented Jul 1, 2012 at 4:42
  • The most secure systems often have the least usability. My point in this question is that security can be easily improved without compromising usability, but is not focused on enough.
    – Rohan
    Commented Jul 1, 2012 at 6:10
  • I'm not sure I agree about you of the Chrome notification being barely present. First, because it is pretty plainly visible at the top of the page. Unless your page had a very similar colored background, not many users would miss it. Second, because it doesn't matter. Why? Because the browser doesn't load any HTTP content until specifically allowed by the user. I also, personally don't see any usability loss in doing it the Chrome way.
    – Mike
    Commented Jul 4, 2012 at 4:22
  • And as for security depending on "what's going through", when it comes to application development, ALWAYS assume the worst and prepare for it. If an HTTPS page can have absolutely nothing of interest, great. But it can also contain your bank account information, social security number, credit card number, PayPal account info, etc. My question wasn't "is it always a bad idea", but more along the lines of "could it ever be a bad idea in any circumstances, no matter how obscure". If the answer to the second is "yes", then browser developers should prevent this from happening.
    – Mike
    Commented Jul 4, 2012 at 4:26
  • I agree with you Mike. I didn't mean the Chrome popup in a negative way, I'm just saying Firefox makes it foolproof. Normal users are allergic to reading, half the people that use SSH don't know what the fingerprint is and blindly hit yes.
    – Rohan
    Commented Jul 4, 2012 at 9:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .