3 ms·
can you explain how this is a charade? I would think that posting my username & password from a http site to a https site still does ssl negotiation before send
by etherealG 15y ago
can you explain how this is a charade? I would think that posting my username & password from a http site to a https site still does ssl negotiation before sending that username and password along a network pipe. Doesn't sound like a charade to me.
- mnutt 15y agoThe only problem is that someone can MITM your connection to the http page and send you back javascript that steals your password.
- capnrefsmmat 15y agoOr just change the form so it POSTs to their secret evil server, rather than to the secure site.
- burgerbrain 15y agoIt eliminates the positive feedback browsers normally present. No positive feedback is bad news (see sslstrip).