title: are websockets secure or not?
body: <p><a href="http://en.wikipedia.org/wiki/Web_Sockets">wikipedia</a> appears to infers <code>websockets</code> are secure:</p>
  
  <blockquote>
  For web browser support, a secure version of the WebSocket protocol is implemented in Firefox 6 (named MozWebSocket),[2] Google Chrome 14[3] and Internet Explorer 10 developer preview.
  ... Although there are no known exploits, it was disabled in Firefox 4 and 5...
  </blockquote>
  
  <p>but <a href="http://www.w3.org/TR/websockets/">w3</a> states they are insecure:</p>
  
  <blockquote>
  Following HTTP procedures here could introduce serious security problems in a Web browser context. For example, consider a host with a WebSocket server at one path and an open HTTP redirector at another. Suddenly, any script that can be given a particular WebSocket URL can be tricked into communicating to (and potentially sharing secrets with) any host on the Internet, even if the script checks that the URL has the right hostname.
  </blockquote>
  
  <ol>
  <li><p>are <code>http websockets</code> (ws:) secure or not?</p></li>
  <li><p>are <code>https websockets</code> (wss:) secure or not?</p></li>
  <li><p>if not #2, are there documented prophylactic measures?</p></li>
  </ol>