5 ms·
If the page is plain HTTP, it's possible for there to be malicious edits - adding a keystroke logger, changing the form's action to point to somewhere else enti
by cmg 10y ago
If the page is plain HTTP, it's possible for there to be malicious edits - adding a keystroke logger, changing the form's action to point to somewhere else entirely that saves credentials and redirects back to the original service the user meant to log in to, etc. So it matters very much that the page with the credit card or password field is HTTPS.
- Klathmon 10y agoAnd the even more sinister "include a malware payload into an asset which was requested". Drive-by infection of exe's, injecting video streams with payloads that can take advantage of the StageFright vulnerability, not to mention things like session hijacking that can happen if any part of a page is loaded over http. HTTPS is all or nothing, an in-between "only on the pages that need it" isn't going to cut it. This is just the chrome team's first step (actually more like 5th or 6th step in this plan) toward getting there.
- xg15 10y agoUntil of course you get similar vulnerabilities (Heardbleed etc) in the TLS implementation itself...
- geofft 10y agoYeah. You also want the page to redirect back to an HTTPS site when you're logged in, otherwise anyone who can intercept your communication can wait until you've logged in securely over HTTPS, and steal the auth token / cookie / whatever that's sent back through HTTP.