6 ms·
As I understand it, if not everything is HTTPS, the attacker could just inject JavaScript that changes the page to the login page when the user clicks "Log in".
by heinrich5991 11y ago
As I understand it, if not everything is HTTPS, the attacker could just inject JavaScript that changes the page to the login page when the user clicks "Log in". That way, they can still record the password.
- ams6110 11y agoYes, it's disturbing how many sites still do this. Most of the big shopping sites like amazon.com, ebay, Target, WalMart are http until you log in. Was also until recently very common on credit card sites, though all of mine are all https now.
- eterm 11y agoThis is because most people are browsing and not buying, so the caching advantages of unsecured catalogue pages is likely quite large. At least for most of those the login is a separate protected page rather than a https iframe.
- saurik 11y agoI wonder if even simply the overhead of setting up and encrypting the secure connections even just by itself has a measurable effect on people's buying behavior.
- Pharaoh2 11y agoUhh, what caching advantage are you talking about? Everything that can be served cached over HTTP can also be served cached over HTTPS. Unless you are talking about a caching proxy outside of the website control. In that case, they aren't needed, CDNs solved that problem in a much better way.
- toomuchtodo 11y ago> Unless you are talking about a caching proxy outside of the website control. In that case, they aren't needed, CDNs solved that problem in a much better way. There are still parts of the world where caching proxies are used to conserve limited transit bandwidth; CDNs don't solve that.
- paulddraper 11y ago"Everything that can be served cached over HTTP can also be served cached over HTTPS. " Only if you're taking about a browser cache. Any other cache couldn't intercept the data and cache it without alerting the browser (unless you mess around with installing SSL certs).
- ams6110 11y agoYes but the "login" link, the "add to cart" link, etc. is all served over http so could be replaced by a MITM.
- umanwizard 11y agoAmazon cares much less about your security than about the fact that tiny increases in latency decrease conversion dramatically.
- drblast 11y agoYou don't have to wait for the user to click anything. Just read each key press and send a message out. Hard to believe this is still a common vulnerability. Of course, even in 2007 a significant number of bank and credit card web sites operated like this.