4 ms·

Those forms sit in an IFRAME and content is loaded via https. Example from http://seasportdivers.com/ http://seasportdivers.com/ : <iframe src="https://farehar

• eropple 9y ago
  That's not sufficient when the external page can be controlled and the iframe target set by it.
  • slobotron 9y ago
    Agreed that in situation like this it's near impossible to ascertain that iframe target wasn't altered, unless you already somehow know what it was before you got mitmd.
• fiddlerwoaroof 9y ago
  Yeah, that’s a little better but can’t an attacker inject something in the surrounding the age that compromises the iframe? Or even rewrite the iframe to use a proxy under the attackers control?
• fishywang 9y ago
  Maybe the vendor improved since then (it's still not very secure as others and Chrome pointed out), but I remembered that back last Aug I searched for "https" in the source code and that's not the case.
  • slobotron 9y ago
    Even now it doesn't inspire much confidence :)