4 ms·
Actually, having no "https:// https:// into the browser address bar does not mean your password is being sent unencrypted. The password could be into an "https
by lelele 16y ago
Actually, having no "https:// https:// into the browser address bar does not mean your password is being sent unencrypted. The password could be into an "https:// https:// form. I discovered this when I tried registering an online bank account and was stunned at not seeing "https:// https://. A right-click on the form, however, showed the form was encrypted, just like a note on such form said.
I'm still convinced that this is bad UI, however.
To tell you all the story, once I gave up subscribing to such online bank and switched to another one, which had proper security measures in place when dealing with passwords during registration, then the latter immediately sent me a confirmation mail with my credentials! Damage done already.
EDIT: Moreover, having a weak password isn't that a big deal provided there is a maximum attempts count. For instance, my online account password isn't that strong, but after three failed attempts, they lock your account.
- pasbesoin 16y agoI haven't read the article, yet, but if you encounter this situation, the form is subject to man in the middle (MITM) attack on the way to your browser. Given access to that datastream, the destination can easily be changed. Do you check the destination for each such form before you submit? (Not to mention, the page can be compromised to sniff your activity even if you never actually submit.) It's bad UI because it breaks users of the habit -- that took some time and effort to establish -- of looking for a secure connection before entering sensitive information. It's bad security for -- amongst other things -- the reason described above.
- bluesmoon 16y agoIf you read the entire article, he actually covers this point. In short, without SSL on the login page, you're susceptible to DNS poisoning attacks (think logging in to your airline's frequent flier program from an airport's free wifi). Secondly, he shows that most of the sites don't even submit to an SSL URL.