Re: SSL over http instead of https

[Nick Owen <nickowen () mindspring com>]

winsoc wrote:
> Hi list,
> I recently reviewed a web hosting provider, and made the assumption that due
> to them not having https that they were not running SSL on their login
> screens- therefore exposing credentials in cleartext.
> However after reviewing the packets it became apparent that when you entered
> the credentials, there was in fact a ssl handshake and the data was in fact
> encrypted via sslv3.
> Is there any logical reasoning for this- it would appear they use a IIS
> webserver for this purpose.  

Are the using Javascript to encrypt the credentials?  Some banks do that...

--
Nick Owen
WiKID Systems, Inc.
404.962.8983
http://www.wikidsystems.com
Commercial/Open Source Two-Factor Authentication
irc.freenode.net: #wikid