WebApp Sec mailing list archives
RE: Should login pages be protected by SSL?
From: "Almerindo Graziano" <agrazian () unina it>
Date: Tue, 21 Jun 2005 17:52:13 +0100
Amir, I am strong advocate of having SSL-enabled login forms. The reason for that being that SSL is meant to "prove" the authenticity of the website I am giving my credentials to. Nevermind that the non-SSL login form actually submits my credentials securely using SSL. What if the site with the unprotected form is a spoofed one? How do I know it won't take my credentials and just return me an error page or something? I just have to take my chances and hope it will send my credentials to the intended trusted server using SSL; or do I have to inspect the source code of the page to work that out? But I don't want to examine the source code of every non-SSL login page... For this reason I also believe that such practice, especially from notable banking and commercial organizations (your list on the hall of shame), encourages common users (people who are not subscribed to this list :-) to believe that giving their credentials to a non SSL-enabled login page is actually secure. No doubt it can be "secure enough" in some cases and we can present all the risk assessment cases that we want. The issue here is about user education, and user should be educated not to give out their credentials to strangers, which is exactly what happens when they use a non-SSL login form. I hope this provides you with a strong argument for having login pages protected by SSL Ciao Al
Current thread:
- Re: Should login pages be protected by SSL?, (continued)
- Re: Should login pages be protected by SSL? Stefano Di Paola (Jun 21)
- Re: Should login pages be protected by SSL? Saqib Ali (Jun 21)
- Message not available
- Re: Should login pages be protected by SSL? Amir Herzberg (Jun 21)
- Re: Should login pages be protected by SSL? Saqib Ali (Jun 21)
- Re: Should login pages be protected by SSL? Ian Rogers (Jun 21)
- Re: Should login pages be protected by SSL? Amir Herzberg (Jun 21)
- Re: Should login pages be protected by SSL? Achim Hoffmann (Jun 21)
- Re: Should login pages be protected by SSL? Amir Herzberg (Jun 21)
- RE: Should login pages be protected by SSL? maburns (Jun 20)
- Re: Should login pages be protected by SSL? Amir Herzberg (Jun 21)
- Re: Should login pages be protected by SSL? Torsten Mueller (Jun 21)
- RE: Should login pages be protected by SSL? Almerindo Graziano (Jun 21)
- Webapp-level protection/detection of Pharming attacks WebAppSecurity [Technicalinfo.net] (Jun 21)
- Re: Should login pages be protected by SSL? Amir Herzberg (Jun 21)
- Re: Should login pages be protected by SSL? Steve Shah (Jun 21)
- Re: Should login pages be protected by SSL? Amir Herzberg (Jun 21)
- Re: Should login pages be protected by SSL? Steve Shah (Jun 21)
- RE: Should login pages be protected by SSL? Glenn Euloth (Jun 22)