3 ms·
that's exactly my point. I am hoping/assuming chrome would notify the user about this as well.
by tehlike 10y ago
that's exactly my point. I am hoping/assuming chrome would notify the user about this as well.
- joshstrange 10y agoWhy? IIRC cross-origin will prevent the http page from reaching into the https iframe and furthermore the password is being sent over https so google doesn't really care.
- tehlike 10y agoBut since top lev is insecure, an attacker could inject a legit looking form whose destination is set to steal passwords.
- joshstrange 10y agoI guess it depends on the attack this is supposed to stop. This change does prevent sniffing of passwords and protects them while in transit but no, it doesn't prevent MitM attacks. That said google plans on marking all HTTP pages as "Non-Secure" in the not-too-distant future which will help warn against the potential for MitM.