WebApp Sec: Re: Non SSL Bank Login Forms

["Adam Tuliper" <amt () gecko-software com>]

Wil is correct, beware though, users do look for the little "lock" secure symbol in their browsers, so their perception 
is the form won't be secure even if posting to a secure url. This same scenario was brought to my attention from an end 
user wondering where the lock was on their page : )



-----Original Message-----
From: Wil Clouser <clouserw () gmail com>
Sent: Fri, 19 May 2006 05:07:50
To: "wilson.amajohn () gmail com" <wilson.amajohn () gmail com>
Cc: webappsec () securityfocus com
Subject: Re: Non SSL Bank Login Forms

Hi John,

The form itself is not sent over a secure connection, but the action
of the form points to a secure destination.  Since the browser
initiates the request to the destination (and that connection is using
SSL), the POST will be sent securely.

Wil

On 18 May 2006 14:57:49 -0000, wilson.amajohn () gmail com
 wrote:
> Hello all, my question is how can a form have a field that is secure without using SSL.  From my web programming 
> experience I cannot understand a Bank's claim that their login form is secure when there is no SSL used.  "Signing on 
> to secure sites from an unsecure page is a common industry practice"  The POST data has to get to the server if SSL 
> is not used how can they claim it is secure?  I hope I have clarified my question enough
>
> Thanks
>
> John
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Watchfire named worldwide market share leader in web application security
> assessment by leading market research firm. Watchfire's AppScan is the
> industry's first and leading web application security testing suite, and
> the only solution to provide comprehensive remediation tasks at every
> level of the application. See for yourself.
> Download a Free Trial of AppScan 6.0 today!
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
> --------------------------------------------------------------------------
-------------------------------------------------
 Sent using http://www.DWmail.net, a free service
 Check your email [any email, anytime, anywhere]
-------------------------------------------------
Disclaimer: DWmail.net is not responsible for the content sent via it's services.  Additional header information is 
included regarding the source of an email.  If you believe an email is junk you should look for the 'Originating IP' 
message header

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire named worldwide market share leader in web application security 
assessment by leading market research firm. Watchfire's AppScan is the 
industry's first and leading web application security testing suite, and 
the only solution to provide comprehensive remediation tasks at every 
level of the application. See for yourself. 
Download a Free Trial of AppScan 6.0 today!

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------