3 ms·
Your site doesn't use https. It's a bit late to put the clear message after people send sensitive data over an insecure connection.
by daveFNbuck 9y ago
Your site doesn't use https. It's a bit late to put the clear message after people send sensitive data over an insecure connection.
- wyager 9y agoNo form data is sent. Only an active MiTM would make this a risk.
- EGreg 9y agoBut the server page with the form could be MiTM, is the point.
- brazzledazzle 9y agoYep. Even though it posts to https://127.0.0.1 https://127.0.0.1 since the page itself isn't https it could have scripts injected into it over the wire.
- nikisweeting 9y agoDespite having 127.0.0.1 in the action field, the form does not actually submit, you can verify with the dev tools.
- nikisweeting 9y agoCheck again, there was a short period of a few minutes without https when I switched off Cloudflare, but now all http requests are redirected to https.
- daveFNbuck 9y agoGlad that wasn't the case while your site was still phishing!