ggozad/jarn.xmpp.core — Issue #11: Don't load favicons from external sites under https
Author: hannosch
Created: 2011-10-23 19:13:40+00:00
State: open

Problem: You are viewing the stream via a https site. The stream includes linked pages with favicons. If these favicons come from non-https sites you get browser warning about showing insecure content.

I think in this case you shouldn't show the favicon at all. The other solution (as done by for example by yammer via embed.ly) is to proxy the external favicon via something coming from the current site.

Related to that is a privacy problem: If I'm on a secure site, I don't want to sent any signal (http request with my cookies, identity) to the external site from my browser.