<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 12/16/14 10:57 AM, Chris Peterson wrote:<br>
<blockquote cite="mid:54908092.5010104@mozilla.com" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
On 12/15/14 11:29 AM, Martin Thomson wrote:<br>
<blockquote
cite="mid:CAPLxc=VbLHJPvzEqccs3aJ4PQkBxEMv78Mua3wLVaz1wTHk40g@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">I think that the real problem to talk
about is the presence of warning icons for HTTPS origins
with passive mixed content. Those sites currently look
worse than cleartext and that doesn't sit well with me.<br>
</div>
</div>
</blockquote>
<br>
That is a good question: why does the user care about (passive)
mixed content warnings? Is there any user risk if the Firefox
address bar displays mixed content sites with the plain HTTP icon
(while still using HTTPS connections underneath)?<br>
</blockquote>
We shouldn't tell the user they are visiting the site over HTTP if
they are in fact using HTTPS. The page will have access to cookies
that are marked for secure origins only, for example. Mixed passive
content leaks information about the page the user is visiting and
leaks cookies associated with the domain the passive content is
sourced from. Moreover, a MITM can change what the page looks like
(ex: replace an icon to reply to a message with an icon to delete a
message).<br>
<br>
<br>
</body>
</html>