Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?

Question

I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case.

Is there a way to determine and display the state of HTTPS on a page (working vs. not working) within the browser (i.e. as a status on a website somewhere), in addition to the lock icon provided in the URL bar of (most/all) browsers?

I'm trying to figure out a way to blatantly tell users wether the connection is secure or not. Another option would be including some sort of instruction set for how to check, though that's obviously a greater barrier. (If anyone has seen something similar somewhere, I'd love to see an example).

Thanks!

Answer 1

No, this isn't possible. Anything you display on a webpage can be manipulated easily, using things like Javascript and thus cannot be trusted.

The padlock on the browser is the only reliable indication that HTTPS is working on a page.

Answer 2

Well, you can make a Web page display a nice-looking message stating that "yeah, this page is secure, everything is fine", but you cannot prevent a fake Web page from displaying the exact same thing, down to the last pixel. If judges used, as unique witness, the criminal himself, then prisons would be empty...

The URL bar and padlock icon are under the control of the browser, not the page, and are supposed to be immune from manipulation from the page (at least, the server name in the URL bar is supposed to be immune from manipulation).

(My bank, when I connect to its Web site, spawns a nice popup with a big padlock in it. This is purely cosmetic; it does not add anything to security, because a fake bank site would spawn the same popup. I actually feel mildly insulted by that popup.)

Answer 3

Your webpage could display a nice big arrow pointing to where the padlock SHOULD be in the browser, and remind them that it should be green, and the website should be domain.com (or something more appropriate like a question mark icon somewhere tasteful that explains where they should see the padlock in the browser etc)

Answer 4

The only thing I can think of would be a signed browser plugin that they install as a plugin which could possibly display something in a way that a website itself couldn't, but that's probably overly elaborate. Anything on the page itself could be faked and even attempting to do it is likely to reduce security as it will train people to look for proof of security someplace other than the universally correct spot to do it within their browser. (Since they may see your indicator and not bother checking the lock icon.)

Answer 5

If you want to ensure they are only going to connect to your legitimate site, you may want to consider two-factor authentication or certificate based mutual authentication. If it doesn't work, its not legit.

Also, keep in mind that there can be a difference between a secure connection and a connection to the correct host. You can have an attacker make a spoofed site running on HTTPS (though rather unlikely), that will be secure, but not legitimate.

There are a lot of companies that offer "security seals", but as noted in some other responses, these can be faked. Some of them will click through to a vendor, but then the user had to know that the third party is one that can be trusted as well. It's a nice gimmick, but its not really providing extra assurance in a situation where you have no base trust. There are also things like Web Of Trust, where you can see ratings form other people, but again you need to trust them.

As an interesting side note, though, research has shown that people really have no concept of the page versus the browser chrome. Most users are no more likely to trust the lock in the chrome, versus a nice image in the browser page. General end users either don't care about security or don't know. Even if they look at certificate details, they don't know what to do with them. If you put instructions onto the page to check, again, an attacker could fake the same thing, claiming to "ignore the fact the name does not match ours, it is because they are our registered agent".

Whalen, T. and Inkpen, K. M. (2005). Gathering evidence: use of visual security cues in web browsers. In Proceedings of Graphics Interface 2005, GI ’05, pages 137–144, School of Computer Science, University of Waterloo, Waterloo, Ontario, Canada. Canadian Human-Computer Communications Society.

Sunshine, J., Egelman, S., Almuhimedi, H., Atri, N., and Cranor, L. F. (2009). Crying wolf: an empirical study of SSL warning effectiveness. In Proceedings of the 18th conference on USENIX security symposium, SSYM’09, pages 399–416, Berkeley, CA, USA. USENIX Association.

Another example, would be putting a message on your site for a download to tell users to ignore the security warnings about unsigned code, etc. and to continue installing anyway.

Answer 6

Probably not the answer you are looking for, but you might consider an extended validation certificate. It makes an obvious visual difference when connected via SSL though the visual representation varies between browsers.

For example:

Answer 7

If it's important for you that users always access your site via HTTPS, start setting Strict Transport Security headers and then submit for hardcoding in browsers.

While not perfect, it's AFAIK the strongest technical (vs educational) measure you can take.

(Together with mitigating risks like cookie hijacking if a user does visit over HTTP)