4 ms·
What happens if the page is insecure, but the attacker places an iframe in the page with HTTPS url, which then tricks the user into sending their credentials (u
by tehlike 10y ago
What happens if the page is insecure, but the attacker places an iframe in the page with HTTPS url, which then tricks the user into sending their credentials (unsuspecting users will think they are logging into the site).
- joshstrange 10y agoI'm not sure that really fit what is changing here... If the forum is submitted it's going over https even if the iframe is on an http page. If an attacker has the ability to add code (iframe or other) to your site you've already lost.
- tehlike 10y agothat's exactly my point. I am hoping/assuming chrome would notify the user about this as well.
- joshstrange 10y agoWhy? IIRC cross-origin will prevent the http page from reaching into the https iframe and furthermore the password is being sent over https so google doesn't really care.
- tehlike 10y agoBut since top lev is insecure, an attacker could inject a legit looking form whose destination is set to steal passwords.
- joshstrange 10y agoI guess it depends on the attack this is supposed to stop. This change does prevent sniffing of passwords and protects them while in transit but no, it doesn't prevent MitM attacks. That said google plans on marking all HTTP pages as "Non-Secure" in the not-too-distant future which will help warn against the potential for MitM.