Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to download Microsoft Security Essentials on my brand new Windows 7 home PC. The official site presented to me is http://windows.microsoft.com/de-CH/windows/products/security-essentials, as I am located in Switzerland. The link to the actual package then is:

http://go.microsoft.com/fwlink/?LinkID=231276

Obviously, the download is not secured with HTTPS. Why? Would this not be the first thing Microsoft should do? They could deliver the certificate already with the OS to make it really secure.

share|improve this question

5 Answers 5

up vote 15 down vote accepted

It's plain HTTP because all Microsoft software is digitally signed anyway; the signature is embedded in the .exe file and verified by Windows on launch. (I seem to remember that this is a requirement for all files posted in their Download Center.)

Unlike HTTPS, signing the actual download also means you can check the signature everywhere (such as copied from a CD or a friend).

Security warning Signature details

share|improve this answer
    
Thanks for clarifying this to me. I now feel much more comfortable. –  Marcel Oct 12 '12 at 21:18
    
Aren't you making the mistake of assuming that if you've been MITM attacked, you're still downloading Microsoft software? It's actually a sweet spot for building a botnet of some sort, the way I see it. –  Steinbitglis Apr 15 at 13:36

Being transmitted over SSL does not make the download more secure in the way you are thinking. SSL simply hides the data that you are sending and receiving. So for instance, if you are sending a credit card number or login over the internet, an HTTPS connection would prevent any peeper from knowing what the contents of the data you sent contain.

Transmitting a fixed file from an encrypted source would only be, at best, marginally better since the contents of what you are receiving are already public. Even if it was on HTTPS, if someone had the data of where you were transmitting/receiving to/from, they could still likely deduce what you are downloading.

share|improve this answer
4  
Not entirely true. SSL also ensures that the server you are connecting to has been verified, by some Certificate Authority that you trust, to be who they say they are (say microsoft.com for example). Meaning you can be relatively confident that you are actually connection to Microsoft's servers, not some bad guy performing a MITM attack. –  heavyd Oct 12 '12 at 21:08
    
@heavyd: Thanks for mentioning the MITM. –  Marcel Oct 12 '12 at 21:15
1  
@jeff F. : I'm comfortable with anyone knowing that I am downloading the package (I' also advertising that here in superuser :-)) But I want to be sure, that I actually receive what I was looking for, not something else. –  Marcel Oct 12 '12 at 21:17
1  
@Marcel heavyd is correct about the MITM attack, but that type of attack requires additional access of course. –  Jeff F. Oct 16 '12 at 18:12

Microsoft does not use HTTPS because you're not actually downloading the file from Microsoft's servers. The files are delivered using server which Microsoft does not own or control.

The download link you posted is just a redirect link, which on my machine eventually resolved to

http://mse.dlservice.microsoft.com/download/A/3/8/A38FFBF2-1122-48B4-AF60-E44F6DC28BD8/enus/x86/mseinstall.exe 

If you play with the url and make it HTTPS you get a certificate error. The message in Chrome says:

You attempted to reach mse.dlservice.microsoft.com, but instead you actually reached a server identifying itself as a248.e.akamai.net.

Microsoft, like many other companies, uses Content Delivery Networks (CDNs) to deliver its files using server which are geographically close to their users. In this case Akamai is the CDN which is serving Microsoft's downloads.

share|improve this answer
    
if the url reads microsoft.com, how does it come from another source? –  Moab Oct 12 '12 at 22:00
    
@Moab, Microsoft is pointing to the Akamai servers in their DNS entries. When you lookup the particular DNS entry it contains a CNAME entry to the Akamai servers, among other entries. –  heavyd Oct 12 '12 at 22:20
    
Thanks for the explanation! –  Moab Oct 12 '12 at 22:21

There is no need to download over HTTPS. All software on their download centre is signed by Microsoft and authenticated during installation.

share|improve this answer

If you have Firefox or Chrome installed you can attempt to download from Microsoft with this HTTPS Everywhere plug-in for those browsers. https://www.eff.org/https-everywhere

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.