Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

My understanding is that this is just an example of being overly cautious, but if my checkout form contains an unsecure asset on it, that doesn't endanger anybody's credit card numbers from being caught by a man-in-the-middle.

I'm asking this because every once in while, maybe because of cached content or whatnot, somebody writes in saying that they are seeing this "error" (even though there are no unsecure assets on my page), but they want an explanation.

So yes, I can tell all about encryption and certificates and trust and men-in-the-middle. But what do I tell them about this. How do I convince them that the site is 100% safe (and if it isn't let me know that I'm mistaken!)

share|improve this question

migrated from superuser.com Jun 20 '11 at 14:17

This question came from our site for computer enthusiasts and power users.

    
what's the URL of your SSL page? –  pipitas Jun 20 '11 at 11:58

1 Answer 1

up vote 10 down vote accepted

A “mixed scripting” vulnerability is caused when a page served over HTTPS loads a script, CSS, or plug-in resource over HTTP. A man-in-the-middle attacker (such as someone on the same wireless network) can typically intercept the HTTP resource load and gain full access to the website loading the resource. It’s often as bad as if the web page hadn’t used HTTPS at all.

http://googleonlinesecurity.blogspot.com/2011/06/trying-to-end-mixed-scripting.html

Security researchers and many web developers understand and articulate the threat well. There are 3 easy steps to attack the user through a mixed content vulnerability…

1) Set-up a Man-in-the-Middle attack. These are most easily done on public networks such as those in coffee shops or airports.

2) Use a mixed content vulnerability to inject a malicious javascript file. Malicious code will run in an HTTPS website that the user browsers to. The key point is that the HTTPS site has a mixed content vulnerability on it, which means that it executes content downloaded over HTTP. This is where the Man-in-the-Middle attack and Mixed Content vulnerability combine into a dangerous scenario.

“If some attacker is able to either tamper with Javascript or stylesheet files he can effectively also tamper with the other content on your page (e.g. by modifying the DOM ). So it’s either all or nothing. Either all of your elements are served using SSL, then you are secure. Or you load some Javascript or stylesheet files from a plain HTTP connection, then you aren’t secure anymore.”- me

3) Steal the user’s identity (or do other bad things).

http://ie.microsoft.com/testdrive/Browser/MixedContent/Default.html?o=1

Related question: http://stackoverflow.com/questions/3778819/browser-mixed-content-warning-whats-the-point

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.