Logging Onto Apple Support Communities NOT SECURE?

Get a new browser. Look at the url of the site. It begins with https does it not? https signifies a secure (SSL) connection.

*I have NO experience with Opera browser

I use Firefox (late model version TenFourFox 38.2.0 for my PPC Mac) - I have never seen what you describe.

My guess is that there was some "moment" in the process during THAT particular visit that Opera & Apple had some 'miscommunication'.

If this cannot be repeated, that is good evidence that it was a momentary anomaly.

Google Chrome suggests it is more a case of could do better, rather than not secure.

I'm not sure what the 'other resources which are not secure' could be, but it may revolve around the way the 'global footer' is coded on the login page. Elsewhere these are simple links to http destinations but on the sign-in page there is some additional javascript function called by the links when they are clicked on. As far as I can tell there are no images, scripts or css resources that aren't fetched securely.

I shall bring this to the attention of the moderators.

tt2

The other difference is that the key exchange mechanism is RSA rather than ECDHE_RSA which is used on the pages that are seen as secure.

tt2

I too am getting much LESS confidence in security info for IDMSA.apple.com

This is odd. It says what the following images says it says. I am not sure that this is alarming at the BEGINNING of that page, as it is not transmitting anything - YET.

*so much for my "momentary" theory

See also https://www.ssllabs.com/ssltest/analyze.html?d=idmsa.apple.com&hideResults=on

vs. https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2Fdiscussions.apple.c om%2F&hideResults=on

Both get sites an A- for security, but there are more issues with the sign-in page. I don't think there is anything to worry about as such, except for those whose job is to keep everything as tight as possible who probably need to tweak a few settings.

tt2

biowizard wrote:

So it looks like a potential leak to me - OF OUR APPLE IDs ...

I think that is putting it too strong. Check the two links above.

Anyone from Apple care to comment?

That's not their style, but I have altered the hosts to this thread and reiterated the concern. Hopefully they will pass the message on to those responsible.

tt2

biowizard wrote:

So it looks like a potential leak to me - OF OUR APPLE IDs ...

Anyone from Apple care to comment?

Brian

Apple isn't here. It does not look "like a potential leak to me - OF OUT APPLE IDs..." There may be links/images on the secure login page that are not located on a secure page but that does not mean the login is insecure.

turingtest2 wrote:

See also https://www.ssllabs.com/ssltest/analyze.html?d=idmsa.apple.com&hideResults=on

vs. https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2Fdiscussions.apple.c om%2F&hideResults=on

Both get sites an A- for security, but there are more issues with the sign-in page. I don't think there is anything to worry about as such, except for those whose job is to keep everything as tight as possible who probably need to tweak a few settings.

tt2

Agree. You have started the snowball down the hill... I am sure it will get bigger. 🙂

I get the same thing on Firefox.

EDIT: ten PhantomPosts just appeared after this one 😁

I and others have recommended that you use a separate apple id for your forums postings.

R

PS. Sure glad I have taken this approach.

I and others have recommended that you use a separate apple id for your forums postings.

R

PS. Sure glad I have taken this approach.

Thanks for this tip!

How exactly do you go about setting this up?

A picture >= 1000 words

For what it is worth the "insecure elements" turn out to be these two images:

http://images.apple.com/global/elements/breadory/breadcrumb_bg.png =

and http://images.apple.com/global/elements/breadory/breadcrumb_sep.png =

These images are in turn pulled in by https://ssl.apple.com/global/styles/base.css

It ought to be a trivial matter to move those two images to a secure server, or make images.apple.com secure and use secure references to them, nevertheless it is hard to see how modifying either of the images on their host server could pose a risk.

tt2