http to https post form data 4

[Roadki11]

Can anyone think any issue(security) with gathering a user name and password on an unencrypted page and posting it to an https page? I am thinking this should be safe but then again I think it might not be.

thanks,

RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[44nato44]

I normally use the below script to have my entire page https after login.. just to be sure.

If Request.ServerVariables("HTTPS") = "off" Then Response.Redirect "https://[Your page]"

 

[Roadki11]

This is an unusual hosting situation where I wouldn’t be able to secure the site. We would collect (unsecured) the username and password and pass that to a 3rd party https login page. Is the username/password vulnerable in that process is the question? This is just hypothetical; I know I could just use a link to get them to the 3rd party site, just trying to figure out how unsafe my proposal is.



RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[44nato44]

as long as it is not https, it will be vulnerable

Sorry that I cannot help more

 

[Spork52]

It's not secure. See:

http://www.sciencedaily.com/releases/2008/07/080722175802.htm

"Placing secure login boxes on insecure pages: A full 47 percent of banks were guilty of this. A hacker could reroute data entered in the boxes or create a spoof copy of the page to harvest information. In a wireless situation, it's possible to conduct this man-in-the-middle attack without changing the bank URL for the user, so even a vigilant customer could fall victim. To solve this problem, banks should use the standard "secure socket layer" (SSL) protocol on pages that ask for sensitive information, Prakash says. (SSL-protected pages begin with https rather than http.) Most banks use SSL technology for some of their pages, but only a minority secure all their pages this way.

 

[Roadki11]

Thanks to both of you for the replies. Spork52, that was exactly what I was looking for but unable to find. Thanks again guys.


RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen