Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site?
https://www.microsoft.com/en-us/default.aspx
I am able to see the lock icon on Facebook and any other site.
Asked
Active
Viewed 8,167 times
4
-
Accessing Facebook from a server OS? I sense a disturbance, as if a thousand InfoSec engineers cried out in terror... – Graham Hill Jan 06 '13 at 17:23
-
@GrahamHill haha, I would never use FB on a production server. I'm using Server 2012 as a local development OS – makerofthings7 Feb 08 '13 at 00:13
1 Answers
4
It's because the connection is not actually secure: There is an HTTPS error on the page about mixed content. Some data is loaded over HTTP (and not HTTPS), which causes this error. You can see this if you open the page in another browser like Chrome.
Edit: Some more information about mixed content errors, from my answer on this question.
if one of the resources used by the website (such as an image or a script) is loaded over HTTP, the confidentiality cannot be guaranteed anymore. Even though browsers do not send the HTTP Referer header when requesting non-secure resources from a secure page (source), it is still possible for someone eavesdropping on traffic to guess where you're visiting from; for example, if they know images X, Y, and Z are used on one page, they can guess you are visiting that page when they see your browser request those three images at once. Additionally, when loading Javascript, the entire page can be compromised. An attacker can execute any script on the page, modifying for example to whom the bank transaction will go.
When this happens (a resource being loaded over HTTP), the browser gives a mixed-content warning: Chrome, Firefox, Internet Explorer 9
-
Firefox also reports the error, and will not show the padlock icon for the Microsoft site. – Thomas Pornin Jan 05 '13 at 21:07
-
-
-
@SteveS I've always lived on IE and Chrome. Now I'm on a MacBook and learning Safari... amazing what the "other world" is like. I need my pop-ups that tell me something is wrong! – makerofthings7 Jan 05 '13 at 22:35