Google Securing The Web One Discrete Monopolizing Push At A Time

Re:Google Securing The Web One Discrete Monopolizing Push At... by paganel on Friday November 04, 2011 @09:35AM (#3195960)

The fun thing is when you have a secure website and for some reason you have to link to a .png or JS hosted on a different, non-secure domain. Last I checked IE was displaying to the user a very ugly security alert message.

[ Parent | on HN ]

Re:Google Securing The Web One Discrete Monopolizing Push At... by justinschuh on Friday November 04, 2011 @10:07AM (#3196086)

What you're describing is known as a mixed-content vulnerability, which allows an appropriately positioned third-party to replace the content with whatever they chose. In the case of something like an included JavaScript file, you're negating most of the security provided by SSL.

See: http://googleonlinesecurity.blogspot.com/2011/06/trying-to-e...

[ Parent | on HN ]

Re:Google Securing The Web One Discrete Monopolizing Push At... by elubow on Friday November 04, 2011 @12:00PM (#3196529)

Right. I think the goal of all this is to have everyone be on SSL so there aren't any mixed-content vulnerabilities. Hardware has come far enough where SSL is no longer overly taxing to encrypt-decrypt streams between the user and the site. So SSL-enabling a site isn't problematic (and in my opinion should be encouraged). (Full disclosure: I wrote that article).

[ Parent | on HN ]