Mixed web content

There are essentially two modes for retrieving content from the web: unencrypted plaintext using HTTP and encrypted with SSL/TLS using HTTPS. But there are quite a number of web pages out there that mix the two modes, so that some content is retrieved securely while other parts are not. These mixed content pages are of concern because it is difficult to properly warn users that an HTTPS page is potentially insecure because it is getting some of its contents from outside of the encryption protection. Mozilla is gearing up to block some mixed content by default and have a way to alert users to the presence of mixed content.

In a blog post, Mozilla security engineer Tanvi Vyas describes the background of the problem and Mozilla's plans for mixed content. Mixed content can be categorized by whether the insecure content is active or passive. Active content covers web resources like scripts, CSS, iframes, objects, and fonts. These are generally things that can affect the document object model (DOM) of the page. Passive content, on the other hand, cannot affect the DOM and includes things like images, audio, and video.

For fairly obvious reasons, mixed active content is a bigger problem than mixed passive content. That doesn't mean there are no issues with mixed passive content, as there are still privacy and other concerns, but mixed active content is much worse. A seemingly secure page with an https:// URL can instead be infiltrated by a man in the middle to steal credentials, web browsing history, secure cookies, and more.

Starting in Firefox 23, which should be released in mid-August, mixed active content will be blocked by default. Mixed passive content will not be blocked by default, at least partly to try not to contribute to "security warning fatigue" (i.e. warning so frequently that users get overwhelmed and just click "continue" all the time).

According to Vyas, code for mixed content blocking started landing in Firefox 18, but a user interface was not added until Firefox 21 (which is still in beta and should be released in mid-May). Those who want to try out the feature can set the security.mixed_content.block_active_content (active) and security.mixed_content.block_display_content (passive) about:config options to true. Prior to Firefox 21, though, changing those values and reloading the page will be the only way to override the settings.

In her blog post, Vyas goes into a fair amount of detail about the changes made to the user interface in support of mixed content blocking. For one thing, mixed content pages will no longer get the "lock" icon in the address bar, so that users will hopefully be less complacent about them. A new shield icon is used to indicate content that has been blocked, with user-interface elements to disable the blocking for the page (seen at right). That is one of the missing pieces for the earlier versions of Firefox, so per-page blocking and unblocking of mixed content cannot be done.

There are some edge cases to consider, including frames and fonts, both of which have been classified as active content by Firefox (though Chrome, for example, considers frames to be passive). While technically a frame can't alter the DOM of the page, it can do various tricks to fool users into entering sensitive information into insecure frames. Other tricks are possible too. Fonts are another case that are treated as active even though they cannot change the DOM. A malicious font could change what a page says, though, and blocking an HTTP font on a secure page won't break anything since the browser will fall back to a default font. In any case, it is believed that mixed font content is rare.

Many web users will remember the "HTTP content on an HTTPS page" complaint that browsers pop up—some may still be seeing them—though most have probably disabled the message because it is shown too frequently. Instead of a pop-up, simply blocking the content is likely to prove a much better experience, both from a security and a usability perspective. It will also hopefully help site owners and designers find ways to avoid mixed content on the web.