News for hackers. Stuff that matters.

A comment on Six Months Later: Seven Major Websites that Send Passwords Unprotected. Parent comment

Re:Six Months Later: Seven Major Websites that Send Password... by coverband on Friday July 23, 2010 @04:07PM (#1542265)
What are you talking about? HTTP-to-HTTPS post is perfectly fine w/r/t sending info securely. It's especially useful for performance if your login is on a page where less than 10% of your users are expected to login.
[ Parent | on HN ]
Re:Six Months Later: Seven Major Websites that Send Password... by tptacek on Friday July 23, 2010 @05:03PM (#1542400)
No. Attackers will just modify the (insecure) login form so that it posts somewhere insecure, and then relay the creds to the secure handler without you noticing. You can't safely serve a secure login form from an insecure page.
[ Parent | on HN ]
Re:Six Months Later: Seven Major Websites that Send Password... by adamsmith on Friday July 23, 2010 @04:14PM (#1542286)
If you start considering active man-in-the-middle attacks, someone can modify the HTTP page that hosts the login form to, for example, also send the password somewhere else.

For defending against passive MITM, you're right (as far as I know) that HTTP-to-HTTPS is okay.

[ Parent | on HN ]
Re:Six Months Later: Seven Major Websites that Send Password... by run4yourlives on Friday July 23, 2010 @04:37PM (#1542336)
Good Overview: http://paulmakowski.wordpress.com/2009/07/20/http-post-https...
[ Parent | on HN ]