page trying to load scripts from unauthenticated sources?

ChoiSeungHyun

ChoiSeungHyun

High Supremacy Member
Joined
Sep 27, 2015
Messages
37,727
Reaction score
49
saw this while surfing edmw. maybe mods should take a look? :s11:

thanks.

OU2AWal.png
 
bosssaizo

bosssaizo

Senior Moderator
Senior Moderator
Joined
Jun 2, 2015
Messages
19,557
Reaction score
39
Ok figured out the problem liao.

We just installed SSL.

So any content, including image links that does not have https will produce this error on site.

Hope that clarifies.
 
treeskull

treeskull

Greater Supremacy Member
Joined
Mar 24, 2015
Messages
87,345
Reaction score
13,911
BoZcMHcl.png

Just receive this error message

Sent from 你是我的小啊小苹果儿怎么爱你都不嫌多红红的小脸儿温暖我的心窝点亮我生命的火火火火火火 using GAGT
 
davidktw

davidktw

Arch-Supremacy Member
Joined
Apr 15, 2010
Messages
13,551
Reaction score
1,302
bosssaizo said:
Ok figured out the problem liao.

We just installed SSL.

So any content, including image links that does not have https will produce this error on site.

Hope that clarifies.
Click to expand...

The warning of mixture between HTTP and HTTPS contents is a significant security issue.

When you have such warnings that keep popping up from time to time and the end-users are "advised" to ignore such pop up, putting across that it is a benigned behaviour, soon they will NOT BE ABLE to recognise a MITM attack pop up that is caused by the attack host posing an invalid certificate of the same domain name. That is why such warnings MUST BE treated with caution and end-users should be notified to either set their browsers to deny access to any NON-HTTPS resources in a HTTPS enabled website, and be advised appropriately to react with skepticism when any form of warnings are produced by the browser to the relevant website.

In my findings, simply using the Developer Tools in Chrome, one can see that such mixture are not limited to user provided contents which are pointing to NON-HTTPS resources.

The main page alone @ https://forums.hardwarezone.com.sg/, already exposed Advertising GIF resources and CSS resources which are fetched via NON-HTTPS conduit in a HTTPS enabled website. This has nothing to do with user contributed contents and should be rectified as soon as possible.

H0gH9pW.png


Embedding a NON-HTTPS hyperlink will not cause such issue, since what the forum has been doing to opening up hyperlink in a new window, which will then be out of the HWZ domain.

For end-users contents, they are mostly IMAGES or YOUTUBE links are externally fetched contents displayed in the same domain name as HWZ Forum. YOUTUBE already have HTTPS conduit, so all HWZ need to do is for new YOUTUBE embed, only allow HTTPS link and for existing posts which are already embedded with HTTP link, either sieve though the database and perform a data patch to change all YOUTUBE links to HTTPS://...., or perform this job at the client end using a Javascript routine, which can be easily performed using tools like jQuery.

For Images, there are still sites like TINYPIC which does not offer HTTPS access, for these sites, deny such access by removing them, or advice the end-users that breakage in not fetching such contents are expected behaviours to enhance the security of the forum. Sites like IMGUR supports HTTPS for the image resources are acceptable and should be enabled. HWZ can list out a couple of such image repository sites to allow end-users to host their images. HWZ can also opt to lock down all images repositories to a limited set to keep things accountable and secure with the use of CSP, at a latter date for the end-users to comply over time, since old posts will eventually be neglected and prune with the least disruption to the service.

Code: 
<html>
	<head>
		<script src="https://code.jquery.com/jquery-3.3.1.slim.min.js"></script>
		<script type="text/javascript">
		$(function() {
		  $("img").each(function() {
		  	$(this).attr("src", $(this).attr("src").replace(/^http:\/\//, "https://"))
		  });
		});
		</script>
	</head>
	<body>
		<img src='http://i.imgur.com/H0gH9pW.png'>
		<img src='http://i.imgur.com/H0gH9pW.png'>
	</body>
</html>
 
Last edited:
S

smith2006

Arch-Supremacy Member
Joined
Nov 25, 2005
Messages
14,258
Reaction score
1,419
Got this error when trying to login

java.io.IOException: Internal TLS error, this could be an attack
 
You must log in or register to reply here.
Important Forum Advisory Note
This forum is moderated by volunteer moderators who will react only to members' feedback on posts. Moderators are not employees or representatives of HWZ Forums. Forum members and moderators are responsible for their own posts. Please refer to our Community Guidelines and Standards and Terms and Conditions for more information.
Top