What are the potential vulnerabilities that might arise if a webpage is only partially encrypted.
I can think of 2 possibilities:
You can change the non-encrypted parts of the page (HTML, CSS, Images, JS) through a MITM attack to partially change the look of the page.
You could inject malicious JS through the insecure connection in order to steal/modify the encrypted parts of the page thus rendering the entire connection insecure.
Is the 2nd scenario possible or do web browsers incorporate some security mechanisms to prevent it from happening?
This question also has implications with regards to the Stack Exchange n/w, since only the iframe containing the login form inside the login page is encrypted : https://meta.stackexchange.com/questions/96004/login-to-stack-exchange-account-doesnt-use-https-ssl
As @Ladada pointed out, this question is actually broken into multiple parts:
Case 1: An insecure page loading a secure iframe to transmit confidential data
Answer: As davidwebster48 pointed out in his answer, this mechanism is trivially defeated since the insecure parent page can be manipulated to load the iframe with a different page of the attacker's liking. As a side note, this means that StackExchange's login system is vulnerable to MITM attacks despite using https login forms.
Case 2: A secure page loading an insecure page via an iframe
(Assuming no confidential data is handled by the insecure iframe). This case is particularly interesting in that Same-Origin policies also come into the equation. Even if both pages may be from the same domain, since they both use different protocols, (one HTTPS and the other HTTP) this will cause same-origin restrictions to kick in. I am not sure whether these restrictions are enough to stop our attacker dead in his tracks.
Case 3: A secure page linking to insecure JS
My answer: I think this is obviously a fail since the attacker could modify the JS file to access/manipulate the entire page.
Case 4: A secure page linking to insecure sources like images, CSS
Could the attacker change enough of the look of the page to do a phishing attack? Or could he mount a Cross-Site Scripting attack?