0

Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using Firefox on my PC everything works and the certificate is validated.

If I visit the website on my phone, using Dolphin Browser in 3G, I get the following warning:

enter image description here

How can a certificate contain different information on two different devices?

2

It looks like anobii.com are making use of a content distribution network CD Networks. Visiting that page the SSL certificate for static.anobii.com is goes to support5.cdnetworks.net.

So the main content is being served with an ordinary certificate but some of the other content is being served with an invalid certificate, which is what I think is causing your error. what's interesting is that firefox doesn't alert if you go to the main page, but if you pick a resource on that page which is being served from CD Networks and browse directly to that (e.g. https://static.anobii.com/favicon.ico ) you get an SSL warning as below

SSL warning

As to why Dolphin is warning you and firefox isn't, my guess is that it could be difference in how they handle SSL warnings

  • Can there be security risks because of this? – user1301428 Feb 4 '14 at 11:53
  • Interesting question. In practical terms you're unlikely to face big risks from this (the main connection is encrypted with a correct certificate), but whenever a company uses a 3rd party to host some content (in this case CD Networks) there's always an increased risk as there are more possible points of attack in the system (i.e. if someone compromises CD Networks, they may be able to serve malicious content to anobii users) – Rory McCune Feb 4 '14 at 12:25
  • But the connections in both cases will be encrypted right? So the only problem is the increased attack surface? – user1301428 Feb 4 '14 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.