So on a website I get this popup from Firefox: enter image description here

I went ahead and asked the website about it and they say the login is very well submitted encrypted. Why do I still get the popup? Who's lying? How can I find out?

  • That is the warning behaviour which got introduced not too long ago to Firefox.
    – mvw
    Feb 6, 2018 at 14:50
  • chrome has it too I think
    – Journeyman Geek
    Feb 7, 2018 at 2:02
  • I tried the same page in Chrome and Edge, neither of which warned about the form.
    – zedoo
    Feb 7, 2018 at 13:28
  • And funnily, the website support told me to ask the Browser developers why they put false warnings in there.
    – zedoo
    Feb 7, 2018 at 13:29
  • @zedoo Chrome's a bit more subtle, with a "not secure" up the top left. And of course the site will blame the browsers... not that it went well the last time. Can you share the site? I'd like to take a look to confirm.
    – Bob
    Feb 7, 2018 at 13:47

2 Answers 2


they say the login is very well submitted encrypted

That's not good enough. It doesn't matter if the login form is submitted to a HTTPS destination if the page the login form is shown on is not itself encrypted.

This is actually explained on Mozilla's own documentation.

I believe this is what you are seeing:

  • Login form is displayed on a HTTP site
  • Login form submit button goes to a HTTPS site

This is what is required to be secure:

  • Login form is displayed on a HTTPS site
  • Login form submit button goes to a HTTPS site

Another possibility is that they've embedded an HTTPS iframe inside a HTTP document, which runs into similar issues.

Why? Because the login form itself is not secured, there's nothing stopping an attacker from modifying said form. This means they can change the form and make it submit to a non-HTTPS site, or even another website entirely! They could also inject a script that captures your keypresses and sends them to an attacker-controlled site before you even submit the login.

Following this, Firefox will show the warning if the login form itself is detected on a non-HTTPS site, no matter what it's submitting to.

This is a very common issue and a lot of site operators (including sites you'd expect to be very secure, e.g. banks) don't seem to be aware (or just don't care). Troy Hunt has some great blog posts exploring this issue, dating back to five years ago. And of course it's still a common problem today.

  • Very well explained, even if it's essentially what @jcbermu mentioned.
    – zedoo
    Feb 7, 2018 at 13:28

The browser detects that the site is doing at least one of these things:

  • Not using https

  • The connection is only partially encrypted (websites with self-signed certificates or certificates that are not issued by a trusted authority).

  • Is using weak encryption.

The last two issues are cases where even using encryption, the connection is not strongly or fully encrypted, opening a door to eavesdropping or man-in-the-middle attacks.

You can go to ' More information' and check the encryption used:

enter image description here

And clicking on View Certificate you can see the details of the certificate used by the website:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.