Google Chrome → HTTPS → Gmail - SSL problems?

Question

gmail

Hello!

I decided to turn to the habra community for advice.

I'm using the latest version of Google Chrome v13.0.782.220 and noticed a questionable feature when working with Gmail. Immediately after authorization, the browser establishes a secure connection , but as soon as I open a letter from [email protected] (aka PrivatBank), the icon immediately turns gray − .

Connecting to a website securely



Google Chrome detected vulnerable content



Help from Google : www.google.com/support/chrome/bin/answer.py?answer...

Do you think this is due to the content of the email? The letter contains standard information and two images. I tend to believe that this is a jamb on the part of Privatbank.

Answer 1

In this case, it's because of the pictures.
The email links to images via http, not https.
An attacker sitting on the wire and intercepting your traffic can peep and change these pictures, and the browser will not notice this. This will change the appearance of the page without permission. Actually, this is the browser for you and wrote in its warning.
If the js was transmitted unencrypted, then it would be even worse (some sites do this!), An attacker could modify the js for insidious manipulation, but then the icon would be crossed out in red.
Solution: do not display pictures.
Or display images, ignore the gray color, but then you risk the following scenario: if suddenly gmail (by mistake) starts transmitting CSS over bare http (you won't notice this, because the icon was already gray because of the images), an attacker will be able to take advantage of this, change the appearance of the control and information elements of the interface and force you to perform certain actions with the mail.

Answer 2

Clicking on "This sender's pictures will always be displayed. Do not display from now on ." solves the problem of changing the icon status: ↓

Answer 3

Yes, this situation occurs because the page has mixed content, https+http. Most often these are pictures/frames in emails.