Firefox and mixed content

[Ian Young]

Not particularly Shib-specific, but I thought people might be interested in this article (via SANS NewsBites) indicating that Firefox, at least, are cranking up the severity of mixed content warnings.

At this point, it seems to be mixed *active* content only, so things like http-served mdui:Logo elements aren't going to be flagged just yet.  Given how many attacks there have been historically on image processing libraries, I wouldn't be too confident that they won't extend this to display content eventually.

	-- Ian


--Future Version of Firefox Will Block Mixed Active Content by Default
(May 17, 2013)
A future stable version of Firefox will block mixed active content by
default. Firefox 23 Aurora is scheduled for stable release in about
three months.  Mixed active content is described as an HTTPS secured
website that loads some HTTP content, which can make the site vulnerable
to a variety of attacks. Users will have the option of disabling the
content blocker on a site-by-site basis.
http://news.cnet.com/8301-1009_3-57585096-83/future-firefox-takes-tougher-stance-on-mixed-content/
https://developer.mozilla.org/en-US/docs/Security/MixedContent
[Editor's Note (Shpantzer): For an interesting article on the security
implications of HTTP/HTTPS mixer-uppers, see
http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html ]


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4877 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20130522/6bcb98f0/attachment.bin