why does one say "not secure" - Page 1
Forum section: electronics / general

author: Inverted18650
author_rank: Frequent Contributor
timestamp: January 13, 2019, 05:17:48 am
content: Chrome recently updates and I have noticed a few changes but this one stumps me. Why does the same browser see these two tabs differently? One is secure, the other is not.edit: when I view the "inspection" option link in Chrome, I can see the plain test version of the coding and wonder if I post it, can you all help me out. Wonder if I have been comprised in some way.Cheers,Chris

author: amyk
author_rank: Super Contributor
timestamp: January 13, 2019, 05:26:29 am
content: I suspect the "not secure" one is justhttp://www.eevblog.com/...while the other one (which should really say "secure" if they were being consistent...) is https://www.eevblog.com/...The idiots continue to dumb-down browsers by hiding stuff, at the expense of confusing everyone except those who already don't know anything

author: Brumby
author_rank: Unknown
timestamp: January 13, 2019, 05:27:29 am
content: The https URL defines the use of an SSL in the data communication. The other one does not - implying a http connection.As I understand it https: provides two things:1. You are assured that the server you think you are connected to is the server you are connected toand2. Your data is encrypted so that if it is intercepted, it's unreadable.http offers neither of these.

author: helius
author_rank: Super Contributor
timestamp: January 13, 2019, 05:36:04 am
content: In practice, neither of those is a total guarantee. Because certificate authorities have been compromised in the past (and could be again), it is possible to have forged certificates. Machines can also be compromised with locally-installed trusted certs.However, neither is particularly relevant anyway on a publically-viewable web forum. About the only thing TLS (SSL was the old standard) does here is to prevent your ISP from injecting ads or tracking.

author: Mr. Scram
author_rank: Super Contributor
timestamp: January 13, 2019, 05:45:04 am
content: The insecure page likely has third party pictures showing on them which are served without SSL.

author: Inverted18650
author_rank: Frequent Contributor
timestamp: January 13, 2019, 06:02:22 am
content: I disconnected and ran my anti-virus programs to be sure, nothing came back hot.After Chrome did its thing, I went back to my home page, which is just Google.com, and had none of the favs saved like usual. (Typically my most frequented sites populate in two rows of five underneath the "search bar" icon). So I typed EEVBlog.com and went o the forum via the main page and saved that as a fav...that ended up as the "non secure link". Here right now, I went through and typed,https://eevblog.com/forum/and get the "locked" icon.Suppose its nothing to worry about...but Ill clean my systems just to be sure.

author: Brumby
author_rank: Unknown
timestamp: January 13, 2019, 06:28:28 am
content: No, nothing toreallyworry about - but there will be those who can throw out some scenarios. Not impossible, but unlikely.If you want to do a system check, then by all means. I don't believe it is necessary from this experience - but it is always good to maintain vigilance.

author: Mr. Scram
author_rank: Super Contributor
timestamp: January 13, 2019, 07:07:19 am
content: It's unlikely a compromised system would lead to intermittent SSL connections.

author: ajb
author_rank: Super Contributor
timestamp: January 14, 2019, 03:16:00 pm
content: Quote from: amyk on January 13, 2019, 05:26:29 amThe vast majority of people who use web browsers don't know anything about the importance of SSL or web security in general, nor should they have to. You call it "dumbing down", I call it tailoring the user experience to the audience by hiding information that is unclear/usually unimportant and emphasizing the information that actually is important. Even if you DO know about SSL and https vs http, it's super easy to miss that little 's' (or more importantly, its absence), so it absolutely makes sense to call attention to the fact that a particular website isn't using SSL. It probably doesn't really matter for EEVBlog*, but it sure as shit matters on any site where you do things like banking, or entering other personally identifying information.* as long as you're not using the same user/pass here as you do on, say, your bank or your email

author: Kilrah
author_rank: Unknown
timestamp: January 14, 2019, 03:39:03 pm
content: Because eevblog.com lacks a redirection of http traffic to https.If you go to anhttps://eevblog.... URL it will be secure, if you go tohttp://eevblog.... it isn't. You probably have old bookmarks to http addresses.Normally sites with SSL enabled should automatically redirect any http:// URL to https:// to ensure you're using the secured version, but this doesn't seem to be correctly configured on this site so you can still access unsecured.