True HTTPS? How?

Question

/Using Google Chrome/

if i visit:

https://secure.wikimedia.org/wikipedia/en/wiki/File:Nokota_Horses_cropped.jpg

then the:

http://upload.wikimedia.org/wikipedia/commons/d/de/Nokota_Horses_cropped.jpg

is on a HTTP-only server.

So how could i be 100% sure, that if i see the "HTTPS" in the URL bar of my browser that means the full content of the website is really encrypted?

In my example the pictures on wikipedia are not using encryption(?), so a sniffer could know that i'm visiting a wikipedia site about horses.

Should i install a proxy (e.g.: privoxy) that will assure that no HTTP-only elements will load on a "HTTPS site"?

Thanks..

Answer 1

Most browsers enable you to get a warning if you have HTTP content on an HTTPS page. This can be very annoying if you visit sites that mix HTTP content on their HTTPS pages. From your question it appears Wikipedia is one of those. When properly set, Firefox warns me visiting this page.

A web server is not required to offer HTTPS. Many sites do not offer HTTPS, and other may only use it to secure login screens and other content that they deem requires a secure path. Even if you use HTTPS, it is still possible to determine which servers you are browsing. In many cases the server only hosts one site, so the site would be known as well.

Until recently, the certificates required for HTTPS were quite expensive. Depending on the level of trust required, the cost is still high. Banks and other organizations which require a high degree of trust and security will pay high prices for their certificates.

If you wish to hide your traffic from local monitoring, you could use a secure path to a proxy. This may raise red flags with whoever is monitoring your traffic.

If you use a private proxy, anyone downstream of the proxy would be able to determine much of the information you are trying to hide.

Answer 2

You might be interested in HTTP Strict Transport Security sometimes called STS or HSTS. This is a voluntary header a web server can send out to instruct the web browser that the site must always be secure. Chrome is one of the browsers that implement it. http://www.imperialviolet.org/2011/02/17/hstsui.html I think you can add Wikipedia to the default database of HSTS sites in Chrome to enforce HTTPS everywhere, but I'm not sure. Beyond that, to enforce HTTPS to all web browsers and other HTTP clients accessing certain web sites, you will need some kind of proxy. You can also go to the extreme and use Tor and Onion routing to hide the fact you are even visiting Wikipedia.

Answer 3

Related to this is the firefox plugin https://www.eff.org/deeplinks/2010/06/encrypt-web-https-everywhere-firefox-extension

As they note

As always, even if you're at an HTTPS page, remember that unless Firefox displays a colored address bar and an unbroken lock icon in the bottom-right corner, the page is not completely encrypted and you may still be vulnerable to various forms of eavesdropping or hacking (in many cases, HTTPS Everywhere can't prevent this because sites incorporate insecure third-party content).