TESCO Bank Site Security

optmax

The authentication page (second page) of the Tesco Bank login has links to insecure content and so the Chrome browser is suspicious reporting:
"Your connection to the site is encrypted, but Google Chrome has detected mixed content on the page. Be careful if you're entering information on this page. Mixed content can provide a loophole for someone to manipulate the page. This content could be third- party images or ads embedded on the page."

Internet Explorer has no such qualms.

I rang the Tesco Bank Interent Banking helpline (an 0845 number but that's another story...) and they jsut kept repeating "the site is secure".

Surely it is bad practice to include links to insecure content within a secure webpage?

Should I be trusting Tesco Bank's security?

nidO

This is a relatively common (and minor) issue, and the actual insecurity you're seeing won't cause any problems.

The Tesco bank login page itself is fully secured and isn't loading any unsecured content (Chrome's warning is ambiguous and not entirely accurate in this instance), the warning you're seeing is simply being caused because the "Search FAQs" submit button submits any search query you enter (at the FAQ section near the bottom of the page) to an unsecured script, ie their FAQ system.

Is it a problem that the FAQ system is accessed via an unsecured connection: No.
Is it best-practice to make sure that all form submissions from a secured page are also secured so that paranoid browsers (ie Chrome) don't throw up a warning: Yes.

optmax

Thanks for that nidO.

You have manged to reassure my wife whereas I had failed completely!