Fwd: Non SSL Bank Login Forms

["John Kennedy" <wilson.amajohn () gmail com>]

also How would the customer verify that it is secure without first
presenting them with a SSL cert

---------- Forwarded message ----------
From: John Kennedy <wilson.amajohn () gmail com>
Date: May 18, 2006 11:22 PM
Subject: Re: Non SSL Bank Login Forms
To: Wil Clouser <clouserw () gmail com>
Cc: webappsec () securityfocus com

Thanks for the response

How would the action be utilized for SSL? would you just have the full
URL ie https://somesite.com/some_file  ? How does a customer know that
the bank is who they say they are without giving them a SSL cert...
There are other issues with that as well but is out of scope from my
question


On 5/18/06, Wil Clouser <clouserw () gmail com> wrote:
>  Hi John,
>
> The form itself is not sent over a secure connection, but the action
> of the form points to a secure destination.  Since the browser
> initiates the request to the destination (and that connection is using
> SSL), the POST will be sent securely.
>
> Wil
>
> On 18 May 2006 14:57:49 -0000, wilson.amajohn () gmail com
> <wilson.amajohn () gmail com > wrote:
> > Hello all, my question is how can a form have a field that is secure without using SSL.  From my web programming experience I cannot 
> understand a Bank's claim that their login form is secure when there is no SSL used.  "Signing on to secure sites from an 
> unsecure page is a common industry practice"  The POST data has to get to the server if SSL is not used how can they claim it is 
> secure?  I hope I have clarified my question enough
> >
> > Thanks
> >
> > John
> >
> > -------------------------------------------------------------------------
> > Sponsored by: Watchfire
> >
> > Watchfire named worldwide market share leader in web application security
> > assessment by leading market research firm. Watchfire's AppScan is the
> > industry's first and leading web application security testing suite, and
> > the only solution to provide comprehensive remediation tasks at every
> > level of the application. See for yourself.
> > Download a Free Trial of AppScan 6.0 today!
> >
> > https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
> > --------------------------------------------------------------------------
> >
> >



--
-----
Fight back spam! Download the Blue Frog.
http://www.bluesecurity.com/register/s?user=a2VubmVkeV9mYW00OTg1

--
-----
Fight back spam! Download the Blue Frog.
http://www.bluesecurity.com/register/s?user=a2VubmVkeV9mYW00OTg1

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire named worldwide market share leader in web application security
assessment by leading market research firm. Watchfire's AppScan is the
industry's first and leading web application security testing suite, and
the only solution to provide comprehensive remediation tasks at every
level of the application. See for yourself.
Download a Free Trial of AppScan 6.0 today!

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------