Ask HN: Why mobile Chrome says HTTPS site is not secure?

https://news.ycombinator.com/item?id=33133644

by gtirloni • 4 years ago

1 6 4 years ago

news.ycombinator.com

It happens often (at home, mobile or random wifi networks): Chrome shows a warning that a website is not secure and asks if I want to proceed. I do and the website shows the lock icon and the certificate is valid.

It just happened with HN.

What gives?

emedchill2• 4 years ago

Without you proving an example, my best guess is that the site is using weak ciphers or old SSL/TLS versions. Technically, it has some security but not good enough by today's standards.

If you run into that issue again, try running it though https://www.ssllabs.com/ssltest/

emedchill2• 4 years ago

It could also be that your phone has some sort of MITM or packet sniffing program that is doing an insecure redirect, capturing your intended destination then sending you to it.

gtirloni3• 4 years ago

Could a captive portal be doing that? How would it capture my request? Maybe DNS intercept that redirects me to some of its servers before doing a redirect?

I don't think I have an app sniffing my phone. It's not rooted and it happens semi-randomly.

gtirloni3• 4 years ago

I mentioned it happened on HN (news.ycombinator.com) just before I posted this submission.

josephcsible• 4 years ago

What happens if you go to an insecure site like http://neverssl.com/ on the same device and browser?

gtirloni3• 4 years ago

Nothing, it just opens it.

Ask HN: Why mobile Chrome says HTTPS site is not secure?

Related Stories