|
Posted by UKuser on January 3, 2007, 6:32 am
If you were Registered and logged in, you could reply and use other advanced thread options
(incorrectly) this would appear under Sebastians reply.
A
UKuser wrote:
> Hi Sebastian,
>
> Thanks for the information. You're obviously assuming that an attacker
> can get to the unsecured content and modify it. What would stop an
> attacker accessing files on a secure area as well? If SSL just encrypts
> the communication between the webserver and client, how are the SSL
> files any more secure?
>
> Thanks
>
> A
>
> Sebastian Gottschalk wrote:
>
> > UKuser wrote:
> >
> > > I'm going to be working with some SSL pages (php) and wondered if there
> > > were any good design/development sites for security tips etc so I miss
> > > out on making the "obvious" blunders - whatever they may be.
> >
> > The obvious blunders are incompetent Root-CA s. You can easily recognize
> > them: If they're claiming to be Root-CA, then they're incompetent.
> >
> > > I've found: http://blogs.msdn.com/ie/archive/2005/04/20/410240.aspx
> > > which is very good and lists two possible problems. Here then is the
> > > newbie question.
> > >
> > > If a form is hosted on a HTTP (non secure) site and points to a HTTPS
> > > in the action tag, does this mean that the page has already made the
> > > SSL connection/handshake?
> >
> > No.
> >
> > > Does the browser recognise the potential for
> > > a HTTPS connection and therefore do the same as if it was a full SSL
> > > page?
> >
> > Yes. However, this won't help if the attacker can modified the unsecure
> > form to transmit the content to somewhere else.
> >
> > > Secondly, why is mixed content so bad (any sites would be great)? I
> > > appreciate various elements could be secure/unsecure but how would that
> > > pose a risk?
> >
> > Simple: The nonsecure content can be modified by an attacker, and such a
> > modified content can also modify/overwrite/extend the secure content.
> >
> > Trivial example: Overwrite an nonsecure CSS stylesheet with "body {
> > display:none; visible: no; content-before:<!-- put your phishing website
> > here -->}"
| 
XML site map