On my way to Microsoft to download "security essentials", I noticed that the download page isn't a secure site. Is this legitimately the case, or an indication that I may be compromised in some way? (Some kind of name resolution hijack?)
-
Since the executable you download is signed, I think they made it easier for a proxy server to cache rather than go for extra privacy. – user2313067 Jan 10 '15 at 23:34
It appears that Microsoft.com does indeed run using standard HTTP rather than HTTPS (TLS/SSL secured). However, their website can be accessed using HTTPS if you enter: https://www.microsoft.com. This causes the main page to display over a secured connection.
That said, their security essentials page (http://windows.microsoft.com/en-us/windows/security-essentials-download) is not accessible using HTTPS and results in a 404 Not Found error (if your browser even lets you open it).
I do not know why Microsoft would use standard HTTP instead of secure HTTPS, but it appears that they do. It seems like a poor set-up on their part, but I do not believe this means either you or they are compromised.
