Some sites seem to disable the protection by themselves, how can I prevent that?

Question

When I visit some specific sites e.g. www.youtube.com or https://www.vliegtickets.nl, two things happen:

1. The menu item for 'temporarily allow all this page' disappears
2. The HTTPS connection is marked as 'Connection is not secure' because 'you have disabled protection for this page'

However I had never visited the second page before so I definitely did not disable the protection. The 'connection is not secure' message has a button 'Enable Protection' but this does not do anything at all.

I'm using Tor Browser 6.0.6. What can be the problem here? Is it a setting?

Answer 1

What you're describing is "mixed content", this is where a website will be loaded over https but the pages code itself will then ask it to load resources into the page over an http connection.

Mixed-content invalidates any protection of the page, since an adversary with the ability to inject content into http streams could use this to tamper with the page content.

There is a bug about the protection not being enablable, at #16527, but there's not a lot of detail about the root of the issue at the moment.

Enabling it would likely break some websites (although, frankly, the websites should be considered broken in the first place) but if it's required you can manually enable them by going to about:config and setting security.mixed_content.block_active_content and security.mixed_content.block_display_content to true.