Re: [MIX] Require HTTPS scripts to be able to anything HTTP scripts can do.

On Mon, Jan 5, 2015 at 2:50 PM, Jim Manico <jim.manico@owasp.org> wrote:

> > A site that is almost entirely HTTPS, but with HTTP used to retrieve
> some data resources, seems to be better than having the site entirely HTTP,
> no ?
>
> I'd say no. Once you let any part of your website be loaded over HTTP,
> HTTPS is completely undermined. The benefits of confidentiality,
> integrity and authenticity only exist when your entire site is HTTPS.
> I see mixed content and HTTP as being the same, essentially.
>

FWIW, if all the resources retrieved over HTTP were protected with
sub-resource-integrity, then I think you have lost only some
confidentiality and you still have ​integrity and authenticity.

...Mark



>
> --
> Jim Manico
> @Manicode
> (808) 652-3805
>
> > On Jan 5, 2015, at 4:53 PM, Mark Watson <watsonm@netflix.com> wrote:
> >
> > A site that is almost entirely HTTPS, but with HTTP used to retrieve
> some data resources, seems to be better than having the site entirely HTTP,
> no ?
>