From: Adam Tuliper (amtgecko-software.com)
Date: Fri May 19 2006 - 08:26:13 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Wil is correct, beware though, users do look for the little "lock" secure symbol in their browsers, so their perception is the form won't be secure even if posting to a secure url. This same scenario was brought to my attention from an end user wondering where the lock was on their page : )

-----Original Message-----
From: Wil Clouser <clouserwgmail.com>
Sent: Fri, 19 May 2006 05:07:50
To: "wilson.amajohngmail.com" <wilson.amajohngmail.com>
Cc: webappsecsecurityfocus.com
Subject: Re: Non SSL Bank Login Forms

Hi John,

The form itself is not sent over a secure connection, but the action
of the form points to a secure destination. Since the browser
initiates the request to the destination (and that connection is using
SSL), the POST will be sent securely.

Wil

On 18 May 2006 14:57:49 -0000, wilson.amajohngmail.com
 wrote:
> Hello all, my question is how can a form have a field that is secure without using SSL. From my web programming experience I cannot understand a Bank's claim that their login form is secure when there is no SSL used. "Signing on to secure sites from an unsecure page is a common industry practice" The POST data has to get to the server if SSL is not used how can they claim it is secure? I hope I have clarified my question enough
>
> Thanks
>
> John
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Watchfire named worldwide market share leader in web application security
> assessment by leading market research firm. Watchfire's AppScan is the
> industry's first and leading web application security testing suite, and
> the only solution to provide comprehensive remediation tasks at every
> level of the application. See for yourself.
> Download a Free Trial of AppScan 6.0 today!
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
> --------------------------------------------------------------------------
>
>

-------------------------------------------------
 Sent using http://www.DWmail.net, a free service
 Check your email [any email, anytime, anywhere]
-------------------------------------------------
Disclaimer: DWmail.net is not responsible for the content sent via it's services. Additional header information is included regarding the source of an email. If you believe an email is junk you should look for the 'Originating IP' message header

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire named worldwide market share leader in web application security
assessment by leading market research firm. Watchfire's AppScan is the
industry's first and leading web application security testing suite, and
the only solution to provide comprehensive remediation tasks at every
level of the application. See for yourself.
Download a Free Trial of AppScan 6.0 today!

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]