Page 50 - Payout Magazine Online Volume 10.01

Google Chrome
Google is making good on its promise to
favor websites with SSL, but a recent
announcement from the search giant reveals
how serious they are about improving the
security and privacy and of their users.
Google’s Chrome browser will now start
blocking web assets on HTTPS pages when
some of those assets are delivered via
insecure HTTP connections.
What is Mixed Content?
There are two types of content delivered to are spending 90% of their browsing time on
web browsers: content served over a secure,
encrypted HTTPS connection, and content
served over an insecure HTTP connection.
Content delivered via HTTPS is encrypted
and cannot be intercepted and tampered with
by hackers. It’s for this reason that HTTPS is
essential for websites dealing with private and How Mixed Content Affects Users’
sensitive information from its visitors.
Over the last few years, the web has
steadily migrated towards the more secure
HTTPS protocol. The Chrome browser now
issues warnings to users that sites using only
HTTP are insecure.
Mixed content is when a web page pulls in
content from other sources that may not be
secured by HTTPS. Some material is delivered
via HTTP, and some finds its way via HTTPS.
These pages are considered mixed content
because the SSL protocol doesn’t fully secure
the page. Google states that mixed content
degrades the level of security, privacy, and
user experience its users can enjoy.
According to Google, mixed content
weakens HTTPS.
“Requesting subresources using the
insecure HTTP protocol weakens the security
of the entire page, as these requests are
50 PAYOUTMAGAZINE
To Start Blocking
Mixed Content
vulnerable to man-in-the-middle attacks.”
[* https://developers.google.com/web/
f u n d a m e n t a l s /s e c u r i t y /p r e v e n t - m i xe d - of being wholly secure or insecure, it will fit
content/what-is-mixed-content#mixed_
content_weakens_https]
Google Chrome updates will eventually
default to the new setting of blocking mixed
content to help improve the user experience
and increase their level of privacy and security.
Google has also stated that more users
secure sites.
“We’re now turning our attention to making
sure that HTTPS configurations across the
web are secure and up-to-date.”
Security
The current situation allows web pages
to load web assets from both secure and
insecure pages. The vulnerable assets open
pathways for hackers to intercept the data
and modify the code or switch out the content
to whatever they like.
For example, if you are browsing a site with
mixed content on a public Wi-Fi network, the
web page could pull in a JavaScript file over
HTTP. On an insecure connection, the code
could be modified to do whatever the hacker
wanted.
Most modern browsers are already
defaulting to blocking the most dangerous
type of content: iframes and scripts. However,
there are other assets, such as video, audio,
and images, which will usually load without
any issues. Over time, a user’s security will be
significantly diminished.
Web surfers will also receive confusing
mixed messages about the page. Instead
somewhere in between those extremes.
Even though the web was initially built on
the HTTP protocol, it’s not a good idea to
deliver mixed content in this way. Google, with
its Chrome browser, is attempting to create a
more secure internet for everyone by making
it more challenging to deliver content using an
outdated and insecure protocol.
Rolling out Mixed Content Blocking
To implement mixed content blocking,
Google has embarked on a gradual rollout,
with the next three planned Chrome releases
employing different levels of blocking.
� Step 1
In December 2019, an additional setting,
“Site Settings,” will be added to the menu
system. Internet users will have the option
to unblock mixed content, which has been
blocked via Google Chrome’s default content
blocking setting (including iframes and
scripts).
When the user opts-out of the blocking
feature, the mixed content will continue to
download as insecure assets. The locked icon
will then be replaced with an insecure icon.
� Step 2
The Chrome update, Chrome 80, is
planned for a January 2020 release and will
begin auto upgrading insecure assets such as
video and audio files to the HTTPS standards.
If these assets fail to load over HTTPS, then
they will be blocked from downloading.