WebApp Sec mailing list archives

Non SSL Bank Login Forms


From: wilson.amajohn () gmail com
Date: 18 May 2006 14:57:49 -0000

Hello all, my question is how can a form have a field that is secure without using SSL.  From my web programming 
experience I cannot understand a Bank's claim that their login form is secure when there is no SSL used.  "Signing on 
to secure sites from an unsecure page is a common industry practice"  The POST data has to get to the server if SSL is 
not used how can they claim it is secure?  I hope I have clarified my question enough

Thanks

John

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire named worldwide market share leader in web application security 
assessment by leading market research firm. Watchfire's AppScan is the 
industry's first and leading web application security testing suite, and 
the only solution to provide comprehensive remediation tasks at every 
level of the application. See for yourself. 
Download a Free Trial of AppScan 6.0 today!

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------


Current thread: