Re:Chrome 68 will mark all HTTP sites as “not secure”
by slobotron on Thursday February 08, 2018 @09:39PM
(#16337496)
Those forms sit in an IFRAME and content is loaded via https. Example from http://seasportdivers.com/ :
<iframe src="https://fareharbor.com/embeds/book/seasportdivers/?full-item...
Re:Chrome 68 will mark all HTTP sites as “not secure”
by eropple on Thursday February 08, 2018 @10:01PM
(#16337583)
That's not sufficient when the external page can be controlled and the iframe target set by it.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by slobotron on Thursday February 08, 2018 @11:22PM
(#16337869)
Agreed that in situation like this it's near impossible to ascertain that iframe target wasn't altered, unless you already somehow know what it was before you got mitmd.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by fiddlerwoaroof on Thursday February 08, 2018 @10:02PM
(#16337584)
Yeah, that’s a little better but can’t an attacker inject something in the surrounding the age that compromises the iframe? Or even rewrite the iframe to use a proxy under the attackers control?
Re:Chrome 68 will mark all HTTP sites as “not secure”
by fishywang on Thursday February 08, 2018 @10:49PM
(#16337769)
Maybe the vendor improved since then (it's still not very secure as others and Chrome pointed out), but I remembered that back last Aug I searched for "https" in the source code and that's not the case.
What do you think is a random decision?
> However i think that sites should make decisions on their configuration
It's OK when they have ideas what they are doing, but that's not always the case.
Before my trip to Kaua'i I googled some dive shops on the island to book a scuba diving trip. Every dive shops on the island seems to be using the same vendor to process online order of the reservation, which has the same form to input credit card number, and has some text around it saying "it's secure". They are not secure. They are on HTTP: https://twitter.com/fishywang/status/895133987525476354