Re: Growing Bad Practice with Login Forms

[Merlijn Tishauser <merlijn () begeleidingentraining nl>]

On 27-jul-04, at 17:08, Dan C Crawford wrote:

> I just ran a packet capture of logging into a service that uses a 
> nearly
> identical form as found on ISACA. It definitely setup the secure SSL
> connection prior to transmitting my logon data.

I had to design my own loginform couple of weeks ago.
I was puzzled by the same question as the original poster was.

But I totally agree with the sender above.
I set up ethereal on both my webserver as on a client.
Er was absolutely no exchange of login data before the SSL handshake or 
after cancellation of the transaction.


my 0.02 cents

Merlijn