WebApp Sec mailing list archives
Re: Should login pages be protected by SSL? (and comment to moderator)
From: Amir Herzberg <herzbea () macs biu ac il>
Date: Tue, 21 Jun 2005 22:18:48 +0200
Andrew van der Stock wrote:
On page two, it says for clients / card holders / admins / POS / ATM they state:Thanks - that's pretty clear, I must have missed it... Can you please resend me the original document, I may have erased it by mistake?"1 Network (e.g. Internet) – must have authentication and encrypted communication to web and/or application server"I don't think they get much clearer than that. MUST to my standards jaundiced eye means "no exceptions". AND means both authentication and encryption at the same time. So basically, I think that covers off SSL logins - in my book, Visa / MC require it for Internet websites - no exceptions.
thanks, Amir Herzberg
Thanks! And sorry - I didn't notice you are also the moderator... Honest mistake.thanks, Andrewps. On the bounces, ezmlm should remove them automatically after 5 days. But if it doesn't get better, I'll hassle the Symantec admin staff to help me as I can't always see who the bounces are.
-- Best regards, Amir Herzberg Associate Professor Department of Computer Science Bar Ilan University http://AmirHerzberg.comNew: see my Hall Of Shame of Unprotected Login pages: http://AmirHerzberg.com/shame.html
Current thread:
- Should login pages be protected by SSL? Amir Herzberg (Jun 20)
- Re: Should login pages be protected by SSL? Andrew van der Stock (Jun 20)
- Re: Should login pages be protected by SSL? Amir Herzberg (Jun 21)
- Re: Should login pages be protected by SSL? Andrew van der Stock (Jun 21)
- Re: Should login pages be protected by SSL? (and comment to moderator) Amir Herzberg (Jun 21)
- Re: Should login pages be protected by SSL? (and comment to moderator) Andrew van der Stock (Jun 21)
- Re: PCI standards & Should login pages be protected by SSL? Peter Watkins (Jun 21)
- RE: PCI standards & Should login pages be protected by SSL? Lyal Collins (Jun 22)
- Re: Should login pages be protected by SSL? (and comment to moderator) Amir Herzberg (Jun 21)
- Re: Should login pages be protected by SSL? Amir Herzberg (Jun 21)
- Re: Should login pages be protected by SSL? Andrew van der Stock (Jun 20)
- Re: Should login pages be protected by SSL? Steve Shah (Jun 21)
- Re: Should login pages be protected by SSL? Amir Herzberg (Jun 21)
- [summary] Re: Should login pages be protected by SSL? Steve Shah (Jun 22)
- Re: [summary] Re: Should login pages be protected by SSL? Ole Kasper Olsen (Jun 23)
- Rephrased: Should login pages be protected by SSL - although it won'thelp most users? Amir Herzberg (Jun 23)
- Re: [summary] Re: Should login pages be protected by SSL? Devdas Bhagat (Jun 23)
- Re: [summary] Re: Should login pages be protected by SSL? Michael Silk (Jun 23)
- Re: [summary] Re: Should login pages be protected by SSL? Wolfgang Reder (Jun 24)
- Re: [summary] Re: Should login pages be protected by SSL? Michael Silk (Jun 24)
- Re: Should login pages be protected by SSL? Dave Ockwell-Jenner (Jun 22)