3 ms·
For good measure you should list websites allowing you to enter a password on a non-https page, too. That's plain text, too.
by fooyc 12y ago
For good measure you should list websites allowing you to enter a password on a non-https page, too. That's plain text, too.
- omervk 12y agoWe have a few of those :)
- IbJacked 12y agoNot necessarily. The login page could be http, but as long as it posts to an https address, the password is never transmitted in plain text.
- fooyc 12y agoIf your login page is HTTP, your HTTPS receiver is useless. A MITM can just change the form's target URL in the HTTP login page. On inject any scripts.