WebApp Sec mailing list archives
Fwd: Non SSL Bank Login Forms
From: "John Kennedy" <wilson.amajohn () gmail com>
Date: Thu, 18 May 2006 23:32:36 -0600
---------- Forwarded message ---------- From: John Kennedy <wilson.amajohn () gmail com> Date: May 18, 2006 11:22 PM Subject: Re: Non SSL Bank Login Forms To: Wil Clouser <clouserw () gmail com> Cc: webappsec () securityfocus com Thanks for the response How would the action be utilized for SSL? would you just have the full URL ie https://somesite.com/some_file ? How does a customer know that the bank is who they say they are without giving them a SSL cert... There are other issues with that as well but is out of scope from my question On 5/18/06, Wil Clouser <clouserw () gmail com> wrote:
Hi John, The form itself is not sent over a secure connection, but the action of the form points to a secure destination. Since the browser initiates the request to the destination (and that connection is using SSL), the POST will be sent securely. Wil On 18 May 2006 14:57:49 -0000, wilson.amajohn () gmail com <wilson.amajohn () gmail com > wrote: > Hello all, my question is how can a form have a field that is secure without using SSL. From my web programming experience I cannot understand a Bank's claim that their login form is secure when there is no SSL used. "Signing on to secure sites from an unsecure page is a common industry practice" The POST data has to get to the server if SSL is not used how can they claim it is secure? I hope I have clarified my question enough > > Thanks > > John > > ------------------------------------------------------------------------- > Sponsored by: Watchfire > > Watchfire named worldwide market share leader in web application security > assessment by leading market research firm. Watchfire's AppScan is the > industry's first and leading web application security testing suite, and > the only solution to provide comprehensive remediation tasks at every > level of the application. See for yourself. > Download a Free Trial of AppScan 6.0 today! > > https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c > -------------------------------------------------------------------------- > >
-- ----- Fight back spam! Download the Blue Frog. http://www.bluesecurity.com/register/s?user=a2VubmVkeV9mYW00OTg1 -- ----- Fight back spam! Download the Blue Frog. http://www.bluesecurity.com/register/s?user=a2VubmVkeV9mYW00OTg1 ------------------------------------------------------------------------- Sponsored by: Watchfire Watchfire named worldwide market share leader in web application security assessment by leading market research firm. Watchfire's AppScan is the industry's first and leading web application security testing suite, and the only solution to provide comprehensive remediation tasks at every level of the application. See for yourself. Download a Free Trial of AppScan 6.0 today! https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c --------------------------------------------------------------------------
Current thread:
- Non SSL Bank Login Forms wilson . amajohn (May 18)
- Re: Non SSL Bank Login Forms Wil Clouser (May 18)
- Message not available
- Fwd: Non SSL Bank Login Forms John Kennedy (May 18)
- Message not available
- Message not available
- Fwd: Non SSL Bank Login Forms John Kennedy (May 18)
- Re: Non SSL Bank Login Forms Wil Clouser (May 18)
- Re: Non SSL Bank Login Forms Adam Tuliper (May 19)
- http/spnego connections Adam Tuliper (May 19)
- Re: http/spnego connections Saqib Ali (May 19)
- Re: http/spnego connections Adam Tuliper (May 19)
- Re: http/spnego connections Adam Tuliper (May 19)
- Re: Non SSL Bank Login Forms Don Jackson (May 19)
- <Possible follow-ups>
- RE: Non SSL Bank Login Forms James Strassburg (May 19)