Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I got the little gold lock before https:// (which was greyed out) on www.youtube.com

The site uses SSL, but Google Chrome has detected insecure content on the page.

I was logged into YouTube via my Google account, on my homepage I noticed some bizarre suggestions on the right side of the page, most were in another language (eastern European). However, I am located in the UK and never watched any video relating to these suggestions.

Immediately I suspected someone was using my YouTube account from outside, so I removed the account in a panic. My Google account remains active though.

Is it possible I am receiving this statement out of a chrome hiccup? Or something more sinister?

I read up on SSL and I understand the basics of what it is for, so I'm feeling rather concerned.

share|improve this question

migrated from stackoverflow.com Feb 16 '12 at 0:50

This question came from our site for professional and enthusiast programmers.

    
Voted to move to Superuser. I'd suggest contacting Google directly as soon as possible. Also, be sure to change your password and do a full virus scan using the scanner of your choice. –  Chris Laplante Feb 16 '12 at 0:46
3  
YouTube does not officially support SSL. It mostly works but the ads are not served over SSL and will cause the yellow lock. –  abraham Feb 16 '12 at 0:50
    
Also if you are worried about the security of your Google account you should turn on 2-step verification: support.google.com/accounts/bin/… –  abraham Feb 16 '12 at 0:51
    
I setup 2-step verification and changed my password. Should I still contact Google? If the SSL says my info over the air is safe, does this mean in this instance someone could have been monitoring my keystrokes and activity? Also could this be a invulnerability in my WIFI connection also? –  user1212730 Feb 16 '12 at 1:03
add comment

1 Answer

About the warning message :

It only means there is insecure content on the page, for example :

<img src="http://cdn.sstatic.net/superuser/img/favicon.ico" />

Is on the page, there is content on the page which doesn't come to you through ssl ( the image )

There is no link about a keylogger, it only means that the image in http is not encrypted to come to you.

But as a side note having content not in https make it easier to fake it, for exemple if there was on youtube a file :

<script src="http://www.example.com/script.js"></script>

if it was in https it would require certificate associated with www.example.com, but in http just getting you the bad result of dns to ip ( dns injection, adding line in /etc/hosts, ... ) is easier ( and then the bad guy can send any "script.js" he want ).

(It's also possible with https but the bad guy would need to fake certificate and validation of certificate and it's harder.)

About your questions :

Is it possible I am receiving this statement out of a chrome hiccup? => no, there should have been elements ( images, flash, css, script, ... ) displayed on the page but not in https.

Or something more sinister ? => it's a small possibility, but only to access a Google account it might be far-fetched ( but caution is security so changing password and secret question might be a good thing ).

About Google:

On YouTube you can see video watching history and searching history ( but it's possible to delete entries and set to standby the search history, so it's not totally safe even if there is nothing suspicious in the two history )

In the same way but better, in gmail ( if you have a Gmail account with your google account too ) there is last account activity which shows you time, country, IP and method of last activities.

So before deleting the account, you could have looked it up ^^

About wifi vulnerability :

Well firstly everything in https will be encrypted, so even if you wireless is super loose, people shouldn't be able to decrypt any request/reply to/from https content.

Secondly the bad guy should be located in the range of your wifi hotspot.

So I think the only issue with wifi vulnerability ( and the website in https ) should be having in the same time a vulnerability on your computer which would make it easier to dns inject you, or simply directly install a key logger on your computer, ...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.