Mixed Content Blocking/Unsecure Connections

[tpaulr]

Morning, All...

Since the upgrade to V54, I have had a lot of issues with sites not rendering correctly because of blocking of mixed content and/or a multitude of warnings about unsecure connections...

I can count on one hand seeing this pop-up since FF v1, within the last 24 hours I have seen the unsecure connection pop-up on the following, too many other sites didn't render correctly because of mixed content blocking:

Apple Records, Bosch, IoT Institute, Intel, IBM, Siemens, any number of other sites that I use professionally.

I ran all of the usual diagnostics, I still get the warnings, in fact, I can't make any of these as permanent exceptions. I ran everything outside of Sandboxie, all of my security off, still have the same issues.

I have changed nothing, no new add-ons, everything is current.

I'm at a loss...Any ideas?

Thanks, in advance.

[Happy112]

Hi tpaulr !

Would you take a look at these two articles and see if :

a) Any of this looks familiar to you, and
b) This will help you solve your problem(s) ?

https://support.mozilla.org/en-US/kb/mi ... ng-firefox

https://support.mozilla.org/en-US/kb/in ... ng-firefox

(The latter is not just about insecure password warnings)

[tpaulr]

Happy,

Thanks...Yes, it is the issue, I already read the article(s), they were referenced elsewhere in the forum, that's the first thing I do, search.

The issue is why now after this update? Why so many warnings, especially about unsecured connections with these sites?

I even checked my date/time, did all the usual diagnostics, from a clean profile to running without add-ons. Checked all my security software, nothing changed after the update.

I've done this dance a lot of times on the protocol before I post.

I'm stumped.

[Happy112]

@tpaulr,

You're stumped - well, that makes two of us, for quite frankly : my first reaction after reading your post was " Why NOW ?"
Wish I had known that you already went through 'all the usual' - I wouldn't have given you those articles to read.
About the mixed content : are you getting a warning signal or a padlock with a strike through it ?
I get them all the time, and totally ignore them, as they only mean that a certain part of the content of that page is not being transferred through https, and that goes for images, pictures, that sort of thing.
As long as those images are not 'explicit, compromising, very personal ... ' - I don't mind one bit.

As for the insecure warnings :
If they really annoy you and you don't want to ever see them again : you can change the values of these two preferences in 'about:config':

'security.insecure_field_warning.contextual.enabled' and set its value to 'false'

'security.insecure_password.ui.enabled' and set its value to 'false'

Hope this is at least a bit helpful, fact remains that it's weird that you only started getting these annoyances after the last update.
Hven't a clue why - but maybe somebody else will come up with the answer .......

[tpaulr]

Happy,

Let's see if I can be more specific. BTW, I greatly appreciate the links, not a problem.

1. As to the mixed content, what is happening now for the first time, is that the pages don't render properly, and as I mentioned, it has been quite a few sites since the update. The pages look like "no page style", like a page from 25 years ago. I have to go through the process of manually allowing permission for each site. Again, these are major company sites, never happened before now. Apparently, I can't make permanent permission, they are only temporary according to the options.

They simply don't render properly until I give the permission.

2. As for the secure/insecure, I will make the about:config changes.

Thanks for the reminder, hadn't gotten around to it.

Am I making sense? I understand what changes were made 30 odd versions ago (FF23), but this has just started. The pages are all screwed up on all these sites, never happened before.

Thanks...

[Happy112]

Am I making sense?

YOU definately make sense !

Let's try this (if you haven't already) :

If you use extensions (3-bar menu = > Add-ons => Extensions) like Adblock Plus or NoScript or Flash Block that can block content then make sure that such extensions aren't blocking content, disable them to see if that will make a difference.

Going to give you links to two articles (at the risk that you've already read them .... )

https://support.mozilla.org/en-US/kb/tr ... x-problems

https://support.mozilla.org/en-US/kb/up ... celeration


If none of this solves this annoying problem, then I can only hope that somebody else will come to your rescue .......

[tpaulr]

Happy,

Thanks.

As I mentioned in the OP, I ran FF with all add-ons disabled, added one by one, none of them creates the problem, no new add-ons, all updated. I also ran a new profile.

I removed acceleration years ago, my NVIDIA drivers are current.

I use uBlock, first thing I do is disable it, also disable my anti-virus, Sandboxie and VooDoo Shield.

[Happy112]

(Heavy sigh ..... )

Suggesting to start Firefox in Safe Mode is pointless, as you have already disabled and re-enabled all add-ons.

Would you give the Refresh a try ?

https://support.mozilla.org/en-US/kb/re ... d-settings

If that doesn't work either, I can only suggest a clean reinstall and download Firefox from here :

https://www.mozilla.org/firefox/all/

But what I'm really hoping is, that somebody else will come to your rescue with a brilliant solution .......

[tpaulr]

Happy,

No refresh. I'm not a proponent of that approach. I already tried safe mode, that's part of the checklist I always perform.

This computer is fairly new, I did a fresh install of Firefox not long ago, first part of the year, new profile, fresh install of all add-ons, just imported bookmarks.

So, off we go. I'm chagrined, this is a new one on me.

Thanks for all your help.

[RobertJ]

.
tpaulr, could you post the URL of a site that is not rendering correctly each time you visit it?

.

[tpaulr]

Good example: https://www.ioti.com/

The dialogue box by the lock says it's an unsecured connection, I can disable the protection "for now". I can't make a permanent exception, says it's mixed content.

The page doesn't render properly unless I disable the protection, everytime I go back, same thing.

I'm not going to post every link, but this is what has happened, ad nausea, since the last update.

[dfoulkes]

tpaulr
You had mentioned that you tried your sites with a new profile... but did not mention if you had made any changes to it prior to testing with it... did you?

You also mentioned (I think) that you disabled your security software... that doesn't always work... about the only way to really test it is to reboot a computer into safe-mode (network active) ... and then test.

I use two profiles... this loaded one with 30 or so extension... you know... stuff like ublock, noscript etc... I used this one to test that site... allowed scripts and the site worked fine. The setting that Happy mentioned are these...

'security.insecure_field_warning.contextual.enabled'
'security.insecure_password.ui.enabled'

... the first one in this loaded profile is set to false but the second one is still the default.

...as for my Test profile (and that site worked fine) ... both of those prefs are set to default and the only 'filter-type' extension I have in there is u-block...

You might also want to try clearing cache???

From a prior post from Dan Raisch (with minor changes) ...

(If using a version below Firefox 3.5.) Clear the browser cache (Tools->Clear Recent History->select cache->click on "Clear Now" button).

Else... use menu path Tools->Options->Advanced->Network tab->click on "Clear Now" button.)

Delete any cookies relating to the site(s) involved (Tools->Options->Privacy->Show Cookies button).

Note: The above is for Windows so if you're using a different OS refer to this...
http://kb.mozillazine.org/Menu_differen ... x,_and_Mac

[dickvl]

Note that the www.ioti.com website doesn't appear to be designed to be accessed via a secure HTTPS connection.
I see a lot of blocked mixed active content messages when I use the HTTPS version.
This would indicate that you need to use http://www.ioti.com/

If you use an extension that forces a secure connection then you may have to add an exception for such a website (domain).

You can always check the Web Console for error messages about the presence or about blocking specific content
https://developer.mozilla.org/Tools/Web_Console

You can also check the Network Monitor.
https://developer.mozilla.org/Tools/Network_Monitor

[tpaulr]

dfoulkes: No, I did not make any changes to a new profile, I also use it for testing, but it has no add-ons. I did run in safe mode, disabled all my security software. I will add uBlock to my test profile, see the result.

dickvl:I don't use any add-ons that force HTTPS. I will use both tools you mentioned, see what it says.

Update: I added UBlock to my test profile, ran in safe mode and it rendered properly.

This is a starting point, now I can continue.

Thank you all, as always.

[RobertJ]

.
FWIW as dickvl noted, the site renders fine if I use http rather than https.

.