I happened to come across this (govt) website which should be HTTPS-secured, but Chrome does not show the green lock. Instead it shows this:



What does it mean? How can attackers leverage this vulnerability?

The page that your browser displays on the screen might consist of many elements: the HTML code, CSS, images, etc. Also some of the content might be provided, enhanced, or altered by (legitimate) scripts downloaded from the site. These elements might be included from the same server or from other servers.

For Chrome to display the "Your connection to this site is private" message, for each element of the page:


an encrypted HTTPS connection must be established
site certificate (identity) must be valid
non-deprecated protocols and algorithms must be used


If one or more of the elements is included through a non-encrypted HTTP link, then:


if it is a script, Chrome will display a message:


  Your connection to this site is not private because the site loaded an insecure script.


In such case there is a possibility that the script was replaced with a malicious one. Any data you receive from the site or sent to the site can be intercepted and changed.
if it is (only) a passive content (like an image), Chrome will display a message:


  Your connection to this site is private but someone on the network might be able to change the look of the page.


In such case no one would be able to sniff on your data or read the information that the site provided. However by altering the look of the page you might be tricked into performing an action you did not originally intend to, for example resetting your password. Although the password change itself would be secure and legitimate, it might benefit the attacker.

Also, this message is not 100% accurate. Depending on the actual passive content being included, a passive attacker can deduce what actions did you take on the encrypted site. Unlike with HTTPS, with HTTP the full URL would be visible, so if a certain page loaded a unique set of icons, an attacker would be able to tell you reached that page.

