|
If a user lands onto a non-https login page. When a user signs in, the action is pointed to a https url. My question is - is the users information encrypted? Is there a way to sniff and grab the users information? User on login page -> router/internet (info is unencrypted) (users on same network can grab your information) -> https://url (info becomes encrypted) Thanks!
| |||
|
feedback
|
|
It is not secure, as an attacker can perform a man-in-the-middle attack, and change POST target URL on unencrypted page to attacker site, save username and password, and then redirect to original, encrypted page. A victim will not even have a chance to notice that something is wrong. So: don't ever do it. | |||
|
feedback
|
