On my way to Microsoft to download "security essentials", I noticed that the download page isn't a secure site. Is this legitimately the case, or an indication that I may be compromised in some way? (Some kind of name resolution hijack?)
It appears that Microsoft.com does indeed run using standard
HTTP rather than
HTTPS (TLS/SSL secured). However, their website can be accessed using
HTTPS if you enter:
https://www.microsoft.com. This causes the main page to display over a secured connection.
That said, their security essentials page (
http://windows.microsoft.com/en-us/windows/security-essentials-download) is not accessible using
HTTPS and results in a
404 Not Found error (if your browser even lets you open it).
I do not know why Microsoft would use standard
HTTP instead of secure
HTTPS, but it appears that they do. It seems like a poor set-up on their part, but I do not believe this means either you or they are compromised.