News for hackers. Stuff that matters.

A comment on Secure Persistent Login With Very Little SSL. Parent comment

Re:Secure Persistent Login With Very Little SSL by there on Monday July 13, 2009 @05:55PM (#702578)
the form it is submitting to needs to be SSL, but the form itself does not

then how do you guarantee the form is going to submit to an SSL-protected resource? the form and all of your javascript has to be sent over SSL, otherwise any of it can be tampered with to simply bypass your logic and post the form contents to an unencrypted resource.

if you haven't already seen it, watch moxie's blackhat presentation about ssl:

https://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.htm...

[ Parent | on HN ]
Re:Secure Persistent Login With Very Little SSL by hayroob on Monday July 13, 2009 @06:00PM (#702586)
That seems like viable thought. I will watch the presentation when I get a chance, but for now I will modify the article to consider this scenario and my code already forces SSL on the login page and the authentication script.
[ Parent | on HN ]