為什麼我的瀏覽器說一個安全的網站不是完全安全的？

一個人在網際網路上可能會遇到各種各樣的麻煩，因此，儘可能安全地建立一個連線總是一個好主意。但是當你的瀏覽器說一個安全的網站不是完全安全的時候，你會怎麼做呢？今天的超級使用者問答帖子回答了一位憂心忡忡的讀者的問題。...

一個人在網際網路上可能會遇到各種各樣的麻煩，因此，儘可能安全地建立一個連線總是一個好主意。但是當你的瀏覽器說一個安全的網站不是完全安全的時候，你會怎麼做呢？今天的超級使用者問答帖子回答了一位憂心忡忡的讀者的問題。

今天的問答環節是由SuperUser提供的，SuperUser是Stack Exchange的一個分支，是一個由社群驅動的問答網站分組。

問題

超級使用者讀者David Starkey想知道為什麼他的瀏覽器說一個安全的網站不是完全安全的：

I was accessing Pandora via SSL and noticed a few ic*** by the URL. First is this exclamation point in a triangle, indicating the page is not fully secure.

Next to it is a shield. This one says content that is not secure is blocked.

These statements, at least to me, seem to contradict each other. Can someone explain this to me? Is my connection secure or not? I accessed the Pandora website using Firefox 30.0 on Windows 7. I also have HTTPS Everywhere installed.

這是怎麼回事？大衛與潘多拉網站的連線是否安全？

答案

超級使用者貢獻者redburn為我們提供了答案：

This is called a “mixed content” page. From the Mozilla Developer Network (Mixed Content):

If the HTTPS page includes content retrieved through regular, cleartext HTTP, then the connection is only partially encrypted: the unencrypted content is accessible to sniffers and can be modified by man-in-the-middle attackers, and therefore the connection is not safeguarded anymore. When a webpage exhibits this behavior, it is called a mixed content page.

The statements are not contradictory, but complementary, and a little confusing perhaps. The first says the page itself is not fully secure because it contains unencrypted elements (all web browsers will notify you of this), whereas the second notes that these elements have been automatically blocked by Firefox.

If Firefox did not block the unencrypted elements, then strictly speaking, the page would not be secure.

HTTPS Everywhere does not guarantee a secure connection. It will only try to force HTTPS whenever it is available; if it is not, then there is nothing a user or browser can do about it outside of blocking the unsecure content.

有什麼要補充的解釋嗎？在評論中發出聲音。想從其他精通技術的Stack Exchange使用者那裡瞭解更多答案嗎？在這裡檢視完整的討論主題。