WebApp Sec: Re: Re: Defending users of unprotected login pages with TrustBar 0.4.9.93

[Peter Conrad <conrad () tivano de>]

Hi,

On Mon, Sep 19, 2005 at 02:30:01PM -0000, mike03051 () yahoo com wrote:
> As I suspected, the hall-of-shame posted on Amir's site may be a bit misguided since these pages do in-fact submit 
> HTTPS (SSL) logins.
the subject has been discussed about three months ago. Please check the
list archives: http://www.securityfocus.com/archive/107/402824/30/0/threaded

The problem with those pages is not that login information is sent
unencrypted (which it isn't), but that the login form is unauthenticated,
which means it could as well be a phishing site - the user has no way
to tell the difference.

Bye,
        Peter
-- 
Peter Conrad                        Tel: +49 6102 / 80 99 072
[ t]ivano Software GmbH             Fax: +49 6102 / 80 99 071
Bahnhofstr. 18                      http://www.tivano.de/
63263 Neu-Isenburg

Germany