Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am accessing Pandora via SSL and notice a few icons by the URL. First is the exclamation point in a triangle, indicating the page is not fully secure:

Not Secure

Next to it is a shield? This one says content that is not secure is blocked.

Is Secure

These statements, at least to me, seem to be opposites. Can someone explain this to me? Is my connection secure or not?

Accessed via Firefox 30.0 on Windows 7. I also have HTTPS Everywhere installed.

share|improve this question

3 Answers 3

up vote 15 down vote accepted

This is called a "mixed content" page.

If the HTTPS page includes content retrieved through regular, cleartext HTTP, then the connection is only partially encrypted: the unencrypted content is accessible to sniffers and can be modified by man-in-the-middle attackers, and therefore the connection is not safeguarded anymore.

https://developer.mozilla.org/en-US/docs/Security/MixedContent

The statements aren't contradictory, but complementary; and a little confusing perhaps. The first says the page itself isn't fully secure because it contains unencrypted elements (all web browsers will notify you of this), whereas the second notes that these elements have been automatically blocked by Firefox.

If Firefox would not block the unencrypted elements, then strictly speaking the page would not be secure.

(HTTPS Everywhere does not guarantee a secure connection. It will only try to force HTTPS when it's available; if it's not, there's nothing a user/browser can do about that but block the unsecure content.)

share|improve this answer
    
So the connection is secure? –  David Starkey Jul 3 at 15:17
4  
@DavidStarkey main connection to the website is secure. Insecure connections to external resources are blocked. You can use the website securely. –  gronostaj Jul 3 at 15:18
    
A note I'd add here is one of the reasons why this is bad, and is flagged. Suppose you had a login to pandora.com and there is a session cookie sent to .pandora.com that encompasses your login session. If this is also sent during HTTP sessions, your session is now in the clear. You've been taken over. Yes, the server can say "only send this cookie for HTTPS", but you'd have to be a geek and track your server responses to figure this out. So for non-geeks, it will just flag this, though not saying they do a good job saying why this is bad. –  Rich Homolka Jul 3 at 15:46
    
@RichHomolka Would it be a problem to load images from pandorastatic.com (or static.pandora.com with no relevant cookies)? –  user20574 Jul 4 at 1:51
    
@user20574 depends. In general, probably not. The cookies would be domain locked. But there are other ways to leak info across domains (or else doubleclick/google wouldn't be worth so much). Again, it depends on how they coded the page. –  Rich Homolka Jul 4 at 15:37

When you visit a website over HTTP, your connection is vulnerable to eavesdropping and man-in-the-middle(MiTM) attacks. Sites that don't pass sensitive information back and forth (Personable Identifiable Information, Social Security Numbers, Credit card, etc). When you visit a page that is fully served over HTTPS (like PayPal and financial institutions), your connection is authenticated and encrypted. However, when a website hosts HTTP content as well as content served over HTTPS, it's commonly referred to as a mixed content page/site. Most browsers, like Firefox, will automatically block the content that isn't secure. Most pages will still display properly and you will still be able to browse the secure portion of the site.

So are you secure or not secure? As we are never fully secure when browsing the internet; I think it's safe to say that your session is "secure" or as secure as it's going to get from the user's end.

I hope I answered your question.

share|improve this answer

A typical web page will be loaded in lots of different streams. Some of the streams, such as images, may be loaded using HTTPS but some maybe loaded by HTTP.

The text is just saying that those loaded with HTTP will be blocked. If you look at the source for the page you'll probably see some of the content is referenced as HTTP.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.