9

I want to download Microsoft Security Essentials on my brand new Windows 7 home PC. The official site presented to me is http://windows.microsoft.com/de-CH/windows/products/security-essentials, as I am located in Switzerland. The link to the actual package then is:

http://go.microsoft.com/fwlink/?LinkID=231276

The download is not secured with HTTPS. Why? Would this not be the first thing Microsoft should do? They could even deliver the certificate already with the OS to make it really secure.

Improve this question

5 Answers 5

Reset to default
15

It's plain HTTP because all Microsoft software is digitally signed anyway; the signature is embedded in the .exe file and verified by Windows on launch. (I seem to remember that this is a requirement for all files posted in their Download Center.)

Unlike HTTPS, signing the actual download also means you can check the signature everywhere (such as copied from a CD or a friend).

Security warning Signature details

Improve this answer
2
  • Thanks for clarifying this to me. I now feel much more comfortable.
    – Marcel
    Oct 12, 2012 at 21:18
  • Aren't you making the mistake of assuming that if you've been MITM attacked, you're still downloading Microsoft software? It's actually a sweet spot for building a botnet of some sort, the way I see it.
    – Steinbitglis
    Apr 15, 2014 at 13:36
6

Being transmitted over SSL does not make the download more secure in the way you are thinking. SSL simply hides the data that you are sending and receiving. So for instance, if you are sending a credit card number or login over the internet, an HTTPS connection would prevent any peeper from knowing what the contents of the data you sent contain.

Transmitting a fixed file from an encrypted source would only be, at best, marginally better since the contents of what you are receiving are already public. Even if it was on HTTPS, if someone had the data of where you were transmitting/receiving to/from, they could still likely deduce what you are downloading.

Improve this answer
3
  • 4
    Not entirely true. SSL also ensures that the server you are connecting to has been verified, by some Certificate Authority that you trust, to be who they say they are (say microsoft.com for example). Meaning you can be relatively confident that you are actually connection to Microsoft's servers, not some bad guy performing a MITM attack.
    – heavyd
    Oct 12, 2012 at 21:08
  • 1
    @jeff F. : I'm comfortable with anyone knowing that I am downloading the package (I' also advertising that here in superuser :-)) But I want to be sure, that I actually receive what I was looking for, not something else.
    – Marcel
    Oct 12, 2012 at 21:17
  • 1
    @Marcel heavyd is correct about the MITM attack, but that type of attack requires additional access of course.
    – Jeff F.
    Oct 16, 2012 at 18:12
5

Microsoft does not use HTTPS because you're not actually downloading the file from Microsoft's servers. The files are delivered using server which Microsoft does not own or control.

The download link you posted is just a redirect link, which on my machine eventually resolved to 

http://mse.dlservice.microsoft.com/download/A/3/8/A38FFBF2-1122-48B4-AF60-E44F6DC28BD8/enus/x86/mseinstall.exe

If you play with the url and make it HTTPS you get a certificate error. The message in Chrome says:

You attempted to reach mse.dlservice.microsoft.com, but instead you actually reached a server identifying itself as a248.e.akamai.net.

Microsoft, like many other companies, uses Content Delivery Networks (CDNs) to deliver its files using server which are geographically close to their users. In this case Akamai is the CDN which is serving Microsoft's downloads.

Improve this answer
2
  • if the url reads microsoft.com, how does it come from another source?
    – Moab
    Oct 12, 2012 at 22:00
  • @Moab, Microsoft is pointing to the Akamai servers in their DNS entries. When you lookup the particular DNS entry it contains a CNAME entry to the Akamai servers, among other entries.
    – heavyd
    Oct 12, 2012 at 22:20
4

There is no need to download over HTTPS. All software on their download centre is signed by Microsoft and authenticated during installation.

Improve this answer
-1

If you have Firefox or Chrome installed you can attempt to download from Microsoft with this HTTPS Everywhere plug-in for those browsers. https://www.eff.org/https-everywhere

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .