4 ms·
I'm going to ask for an example because I can't believe any business entity actually still does this.
by run4yourlives 16y ago
I'm going to ask for an example because I can't believe any business entity actually still does this.
- coverband 16y agoWhat are you talking about? HTTP-to-HTTPS post is perfectly fine w/r/t sending info securely. It's especially useful for performance if your login is on a page where less than 10% of your users are expected to login.
- adamsmith 16y agoIf you start considering active man-in-the-middle attacks, someone can modify the HTTP page that hosts the login form to, for example, also send the password somewhere else. For defending against passive MITM, you're right (as far as I know) that HTTP-to-HTTPS is okay.
- run4yourlives 16y agoGood Overview: http://paulmakowski.wordpress.com/2009/07/20/http-post-https-bad-idea/ http://paulmakowski.wordpress.com/2009/07/20/http-post-https...
- tptacek 16y agoNo. Attackers will just modify the (insecure) login form so that it posts somewhere insecure, and then relay the creds to the secure handler without you noticing. You can't safely serve a secure login form from an insecure page.
- gxti 16y agodiscover.com -- there's a "log in" link at the top that takes you to a secure page, though.
- deleted 16y ago[deleted]