also How would the customer verify that it is secure without first
presenting them with a SSL cert
---------- Forwarded message ----------
From: John Kennedy <wilson.amajohn@gmail.com>
Date: May 18, 2006 11:22 PM
Subject: Re: Non SSL Bank Login Forms
To: Wil Clouser <clouserw@gmail.com>
Cc: webappsec@securityfocus.com
Thanks for the response
How would the action be utilized for SSL? would you just have the full
URL ie https://somesite.com/some_file ? How does a customer know that
the bank is who they say they are without giving them a SSL cert...
There are other issues with that as well but is out of scope from my
question
On 5/18/06, Wil Clouser <clouserw@gmail.com> wrote:
Hi John,
The form itself is not sent over a secure connection, but the action
of the form points to a secure destination. Since the browser
initiates the request to the destination (and that connection is using
SSL), the POST will be sent securely.
Wil
On 18 May 2006 14:57:49 -0000, wilson.amajohn@gmail.com
<wilson.amajohn@gmail.com > wrote:
> Hello all, my question is how can a form have a field that is secure without using SSL.
From my web programming experience I cannot understand a Bank's claim that their login form
is secure when there is no SSL used. "Signing on to secure sites from an unsecure page
is a common industry practice" The POST data has to get to the server if SSL is not
used how can they claim it is secure? I hope I have clarified my question enough
>
> Thanks
>
> John
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Watchfire named worldwide market share leader in web application security
> assessment by leading market research firm. Watchfire's AppScan is the
> industry's first and leading web application security testing suite, and
> the only solution to provide comprehensive remediation tasks at every
> level of the application. See for yourself.
> Download a Free Trial of AppScan 6.0 today!
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
> --------------------------------------------------------------------------
>
>
--
-----
Fight back spam! Download the Blue Frog.
http://www.bluesecurity.com/register/s?user=a2VubmVkeV9mYW00OTg1
--
-----
Fight back spam! Download the Blue Frog.
http://www.bluesecurity.com/register/s?user=a2VubmVkeV9mYW00OTg1
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire named worldwide market share leader in web application security
assessment by leading market research firm. Watchfire's AppScan is the
industry's first and leading web application security testing suite, and
the only solution to provide comprehensive remediation tasks at every
level of the application. See for yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------
