Re:The Inside Story of How Facebook Responded to Tunisian Hacks
by rst on Monday January 24, 2011 @09:29AM
(#2135216)
But if the page containing the form isn't served through SSL, it's subject to alteration by a man in the middle --- which is what actually happened in this case. And users who don't "view source" every single time have no way to notice the difference before logging in (and precious little after, if the logger quickly resubmits to the real McCoy).
[ Parent
| on HN ]
Re:The Inside Story of How Facebook Responded to Tunisian Hacks
by staktrace on Tuesday January 25, 2011 @06:06PM
(#2141345)
And if the page that has the link to the login form isn't served through SSL, it's subject to alteration by a man in the middle to hijack the login page. And if the page that has the link to the page that has the link to the login form... you get the idea. Use SSL on every page, or you lose.