Re: Bank Of America - sign on process - how is this secure?

From: Henrick Hellström (henrick.hellstrm@telia.com)
Date: 11/27/02 

From: Henrick Hellström <henrick.hellstrm@telia.com>
Date: Wed, 27 Nov 2002 13:14:41 GMT

those who know me have no need of my name wrote:
> in comp.security.misc i read:
>
>
>>I don't think it is idiotic to transmit the entire login page via ssl.
>>
>>Sure, the login form doesn't have to be kept *confidential* like the
>>login password has to, but there is some point in keeping the login
>>page *authenticated* so that the user doesn't have to look at the html
>>source to make sure where the password will be sent.
>
>
> it gives people a false sense of security. a `secure page', one which will
> show the lock symbol, can have an unprotected action url, i.e., http rather
> than https, yet that symbol fakes people into thinking they are safe. (a

Do you mean that the converse might be the case, i.e. that the login
page is a https page displayed with a pad lock, while the user password
is sent unencrypted to a http URL?

I don't think that is likely to be an issue when it comes to internet
banking. What you describe would make the bank liable for any damages
caused by stolen passwords and user identities. It's in the best
interest of the bank not to publish such login pages at their site. The
user might rely on the fact that the login form is authentic (because of
the pad lock) and that the bank is responsible for whatever it does.

> few browsers will degrade their lock symbol as a result of this, which is
> good, but in the general case it is not true.) and there will likely be no
> other warning, because people have, by and large, disabled the notification
> of unencrypted transmission, due in large part to the insecure login pages
> for everything else they use and which they are required to accept.
>

Relevant Pages

  • Elementary security questions
    ... easy to ensure that the login process was handled entirely over SSL, ... converting a request for the login page made via http into a request ... In my JSP ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: SSL Forms Authentication Redirect - Problem Redirecting out of HTTPS
    ... allowing an authentication cookie to be passed over an HTTP ... My login script goes into SSL just fine. ... The load balancer is maintaining server affinity. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: How to implement a automatic login function
    ... a web client which programmatically send http post request to send login ... I am simply trying to simulate a normal login. ... username and password via a post and authenticate using the ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: SSL Forms Authentication Redirect - Problem Redirecting out of HTTPS
    ... allowing an authentication cookie to be passed over an HTTP ... My login script goes into SSL just fine. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Basic password security question
    ... Look at the pages - they never post that form over HTTP - usually the login form posts to an HTTPS address.... ... You need SSL - and if you have it for the rest of your site, why not for you login page too? ... Developing More Secure Microsoft ASP.NET 2.0 Applications ...
    (microsoft.public.dotnet.framework.aspnet.security)