WebApp Sec mailing list archives
Re: Re: Defending users of unprotected login pages with TrustBar 0.4.9.93
From: Peter Conrad <conrad () tivano de>
Date: Tue, 20 Sep 2005 09:06:21 +0200
Hi, On Mon, Sep 19, 2005 at 02:30:01PM -0000, mike03051 () yahoo com wrote:
As I suspected, the hall-of-shame posted on Amir's site may be a bit misguided since these pages do in-fact submit HTTPS (SSL) logins.
the subject has been discussed about three months ago. Please check the list archives: http://www.securityfocus.com/archive/107/402824/30/0/threaded The problem with those pages is not that login information is sent unencrypted (which it isn't), but that the login form is unauthenticated, which means it could as well be a phishing site - the user has no way to tell the difference. Bye, Peter -- Peter Conrad Tel: +49 6102 / 80 99 072 [ t]ivano Software GmbH Fax: +49 6102 / 80 99 071 Bahnhofstr. 18 http://www.tivano.de/ 63263 Neu-Isenburg Germany
Current thread:
- Defending users of unprotected login pages with TrustBar 0.4.9.93 Amir Herzberg (Sep 19)
- <Possible follow-ups>
- Re: Defending users of unprotected login pages with TrustBar 0.4.9.93 mike03051 (Sep 19)
- Re: Defending users of unprotected login pages with TrustBar 0.4.9.93 Nathan Jackson-Eeles (Sep 19)
- Re: Defending users of unprotected login pages with TrustBar 0.4.9.93 J. Lambrecht (Sep 19)
- Re: Re: Defending users of unprotected login pages with TrustBar 0.4.9.93 mike03051 (Sep 19)
- Re: Re: Defending users of unprotected login pages with TrustBar 0.4.9.93 Peter Conrad (Sep 20)
- Re: Re: Defending users of unprotected login pages with TrustBar 0.4.9.93 mike03051 (Sep 20)