Wil is correct, beware though, users do look for the little "lock" secure
symbol in their browsers, so their perception is the form won't be secure even
if posting to a secure url. This same scenario was brought to my attention from
an end user wondering where the lock was on their page : )
-----Original Message-----
From: Wil Clouser <clouserw@gmail.com>
Sent: Fri, 19 May 2006 05:07:50
To: "wilson.amajohn@gmail.com" <wilson.amajohn@gmail.com>
Cc: webappsec@securityfocus.com
Subject: Re: Non SSL Bank Login Forms
Hi John,
The form itself is not sent over a secure connection, but the action
of the form points to a secure destination. Since the browser
initiates the request to the destination (and that connection is using
SSL), the POST will be sent securely.
Wil
On 18 May 2006 14:57:49 -0000, wilson.amajohn@gmail.com
wrote:
Hello all, my question is how can a form have a field that is secure without
using SSL. From my web programming experience I cannot understand a Bank's
claim that their login form is secure when there is no SSL used. "Signing on
to secure sites from an unsecure page is a common industry practice" The
POST data has to get to the server if SSL is not used how can they claim it
is secure? I hope I have clarified my question enough
Thanks
John
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire named worldwide market share leader in web application security
assessment by leading market research firm. Watchfire's AppScan is the
industry's first and leading web application security testing suite, and
the only solution to provide comprehensive remediation tasks at every
level of the application. See for yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------
-------------------------------------------------
Sent using http://www.DWmail.net, a free service
Check your email [any email, anytime, anywhere]
-------------------------------------------------
Disclaimer: DWmail.net is not responsible for the content sent via it's
services. Additional header information is included regarding the source of an
email. If you believe an email is junk you should look for the 'Originating
IP' message header
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire named worldwide market share leader in web application security
assessment by leading market research firm. Watchfire's AppScan is the
industry's first and leading web application security testing suite, and
the only solution to provide comprehensive remediation tasks at every
level of the application. See for yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------
