Re: Basic password security question

Look at the pages - they (should) never post that form over HTTP - usually the login form posts to an HTTPS address....

You need SSL - and if you have it for the rest of your site, why not for you login page too?


-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Hi Joe,

I will be securing the rest of my site with ssl, however I'm referring
only to my login page. A lot of sites , including my bank have a
login page over http and once I am logged in, the remainder of the
pages are over https. How do they secure the password in that case?

"Joe Kaplan" wrote:

No. You should look at the wire traffic. That is just for the UI
displayed by the browser.

If you are doing a secure site where you will be collecting data like
passwords and potentially using cookies for authentication, you must
use SSL.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Opa" <Opa@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5CD20844-7860-4BAB-BD57-AB0DBB43B991@xxxxxxxxxxxxxxxx
Hi all,
I was asked today if setting textmode="password" of a textbox
control
was secure over http. I assumed that the browser does encryption
before
sending it over the wire. Why aren't most login screen forms sent
over
https?
Is my assumption about the browser providing encryption on special
input
fields true? Can anyone explain?
Thanks,

Opa



.

Relevant Pages

  • Re: ModSSL - Knoppix 3.3
    ... NameVirtualHosts and SSL don't mix. ... This automatically pushes an incorrect http request to the secure host over ... > I create some server key & crt. ...
    (Focus-Linux)
  • Elementary security questions
    ... easy to ensure that the login process was handled entirely over SSL, ... converting a request for the login page made via http into a request ... In my JSP ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Web based password reset
    ... Notice that email is NOT secure in general. ... HTTP can also use SSL ... You might also ask this question on one of the Web server newsgroups ...
    (microsoft.public.win2000.active_directory)
  • Re: Are http links after signing in with https secure?
    ... HTTP requests are not secure; ... If IIS only accepts SSL requests, then those links using HTTP will fail. ...
    (microsoft.public.isa.publishing)
  • Re: From http:// to https://
    ... > I have a login page that is secured with SSL and other non secure pages ... As Server.Transefer or response.redirect takes http by default. ... > standard method to transefer pages from normal to SSL page and vice versa. ...
    (microsoft.public.dotnet.framework.aspnet)