On my way to Microsoft to download "security essentials", I noticed that the download page isn't a secure site. Is this legitimately the case, or an indication that I may be compromised in some way? (Some kind of name resolution hijack?)

  • Since the executable you download is signed, I think they made it easier for a proxy server to cache rather than go for extra privacy. – user2313067 Jan 10 '15 at 23:34

It appears that Microsoft.com does indeed run using standard HTTP rather than HTTPS (TLS/SSL secured). However, their website can be accessed using HTTPS if you enter: https://www.microsoft.com. This causes the main page to display over a secured connection.

That said, their security essentials page (http://windows.microsoft.com/en-us/windows/security-essentials-download) is not accessible using HTTPS and results in a 404 Not Found error (if your browser even lets you open it).

I do not know why Microsoft would use standard HTTP instead of secure HTTPS, but it appears that they do. It seems like a poor set-up on their part, but I do not believe this means either you or they are compromised.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.