1

A couple of days ago we noticed that when we go to our online banking login page (using Opera browser as usual) there is no green lock icon there anymore. Instead, there is a grey globe icon which states "unprotected connection" even though it is an HTTPS page.

We also tried using Chrome - same problem. We have checked this problem on two different machines (Windows 7, Windows 8, Ubuntu and mac). Does anyone have any idea what the problem could be and how we could fix it? Is it a problem with the website or with our machines? enter image description here

|improve this question
  • 3
    Well, what does it say when you click on "Details"? There should be more information... – Marc Schütz Jul 31 '18 at 7:13
  • it showing first visited, connection, certificates, errors : "this page contains insecure content" @MarcSchütz – khalidh Jul 31 '18 at 7:26
  • That'll do it - some image or script on the page being loaded over HTTP will mark the whole page as insecure since updates recently to browsers. The site owner needs to fix it, rather than the end user though. – Matthew Jul 31 '18 at 7:29
  • yes, now I got the issue @Matthew – khalidh Jul 31 '18 at 7:33
2

Google Chrome displays a mixed content warning. Google has a good article outlining how to prevent this. Preventing Mixed Content. This is likely to protect against prior harm XSS has caused. Particularly when XSS is performed on a website without HTTP. Although, I cannot see how this would be a problem.enter image description here

Mozilla Firefox displays the connection as secure without any security warnings.

Although, Opera seems to display the connection as "Unprotected connection" when the mixed content warning is given.enter image description here
It can be seen that a secure HTTPS connection is established with a valid certificate and TLS 1.2, etc...

SSL Labs analysis shows yourdomain.com uses HSTS.

Is it a problem with the website or with our machines?

As you can see from the results above, this is not an issue with the client-side, as Opera is designed to respond like this. Instead, it's an issue with the server-side, where the developer did not consider all browsers and how they would respond.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.