What benefit does the IE setting "Block unsecured images with other mixed content" provide?

Question

Internet Explorer has the security setting shown in below screen shot.

Block unsecured images - setting

My understanding is that "unsecured images" are images that are not transmitted over HTTPS.

What I am curious about is why does this setting specify the blocking of images, as opposed to other possible non-HTTPS content?

Is there some benefit that can be gained by blocking images in particular? Or what is the reasoning behind this setting?

score 2 · Accepted Answer · answered Mar 11 '15 at 21:34

The reasoning behind this is that in most cases, the unsecured content is only ad banners, and will not be of any concern. Thus IE allows insecure images on a otherwise secure page by default.

Note that its NOT possible to run an image as JavaScript or executeable code, so a unsecured image cannot affect the page contents on a otherwise secure page.

Other content however, can modify the content on the page, for example a JavaScript loaded over a unsecured Connection could modify the HTTPS page to for example change the action of a form, and if a hacker then modifies the .js file in transit, then they could possible "subvert" the HTTPS page.

However, there is 2 cases where images still might be a concern:

If the image is modified to be "protected by basic auth", then the browser might popup a authentication dialog, that can trick you into thinking the authentication dialog belongs to the HTTPS site. However, IE will warn, see this Picture, if BASIC+HTTP is mixed:

If the attacker uses digest, he will not be able to gain any password information. So never enter any username or password if the dialog carries the warning above, if you're on a HTTPS site. Only DIGEST+HTTP, BASIC+HTTPS or DIGEST+HTTPS will suppress the warning shown above.

Another case where you would want to block insecure images, is if the images itself contain sensitive information, or if sensitive information is transmitted with the images, for example: http://example.org/loadimage.php?creditcardnumber=1234-1234-1234-1234

But both these cases is very uncommon, so you can safely keep the setting off (allow load of insecure images on HTTPS pages)

What is not necessarily as uncommon is transmitting sensitive cookie values. So from an application perspective, all cookies should be marked as "secure" but from a user's perspective, if you don't trust applications to do this, this is when you would want to disable insecure images in mixed content. — Xander, Mar 11 '15 at 22:47

What benefit does the IE setting "Block unsecured images with other mixed content" provide?

1 Answers1