Comodo not really getting the concept of HTTPS

Looks like Troy picked up the Comodo story and demonstrates a MiTM attack here: http://www.troyhunt.com/2013/05/heres-why-you-cant-trust-ssl...

So while loading the seal over standard http is not a security issue in itself there is the problem of mixed content when loaded over https.

This could leave the site open to a MiTM style attack since security fatigue means the user just loads insecure content. The http request could then potentially be redirected to load an alternative content.

Note: Firefox 23 (currently active in Nightly) will block insecure content by default

images are classed as passive content by Firefox 23 so by default they will load just the padlock will not show. More info: https://blog.servertastic.com/firefox-23-to-block-mixed-cont...

Hm, good to know

Even though the embed code has HTTP for the image url, it's still possible to load the images over SSL.

https://www.positivessl.com/images-new/PossitiveSSL_tl_trans...

Which makes it even more stupid that they haven't put this as the source code.