How secure is this login page? [closed]

Question

Unfortunately I cant link to the page (it internal). But I can describe it!

This is a lightspeed systems policy enforcement login page (content filter).

The page is http and there is no iframe with ssl. The login form posts to a javascript function.

So here is my question:

Could this page be secure and if so how?

Answer 1

No. If the page and scripts were not delivered securely in the first place then there is always the possibility that a third party has modified the content. Securing the iframe is not sufficient, since the non-secured content could still contain malicious scripts.

Note that this doesn't mean that your information WILL be compromised if you use this login, merely that the possibility is there.

Answer 2

Short answer: no, you can replace the javascript using a MITM attack with whatever code you want.

Answer 3

Ultimately no.

Though lots of charlatans would say if it posts to an SSL URL then it could be secure, this is flat out wrong:

1. The user doesn't know it does this and to find out takes some element of skill.
2. An active man in the middle can modify the page and/or JavaScript to no-longer post to a secure URL easily enough.
3. JavaScript encryption is such a situation can't even start to be secure for the same reasons.
4. If other pages also aren't encrypted after login it can't have the secure bit set on the cookie and therefore is vulnerable to session hijacking.

Answer 4

A page without TLS (aka SSL) is not secure against eavesdroppers or Man-in-the-Middle attacks. I wouldn't give them any information I want to keep secret like credit card #s or passwords that I don't want to fall into the hands of an attacker. I will however say use dumb passwords for accounts that I don't worry about falling into the hands of an attacker (like a free account to read washington post articles).

Granted that doesn't mean any user on the network can always trivially to eavesdrop/launch a MitM attack. E.g., most LANs are set up in a star network topology, meaning that unless you have access to the central switch (typically only administrators or people working at an ISP), its not easy to eavesdrop in.

Granted say unencrypted wifi is different and makes it easy to eavesdrop. Even wifi with a broken security scheme like WEP or where you know the pre-shared key and observe the WPA handshake that generates the pairwise transient key.