Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Unfortunately I cant link to the page (it internal). But I can describe it!

This is a lightspeed systems policy enforcement login page (content filter).

The page is http and there is no iframe with ssl. The login form posts to a javascript function.

So here is my question:

Could this page be secure and if so how?

share|improve this question

closed as not a real question by Lucas Kauffman, Gilles, dr jimbob, Jeff Ferland Sep 19 '12 at 23:15

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
How fast is this car? I can't describe it but it's read and has black tires. It's streamlined. –  Lucas Kauffman Sep 19 '12 at 20:42
    
ok, its not the best question. But is does address a point: is a page secure without SSL? –  November Sep 19 '12 at 20:43
    
Secure against what? What is the environment, what are the threats, what other countermeasures are in place? –  Gilles Sep 19 '12 at 20:49
    
From what I can make out, Lightspeed Systems produce captive portal login systems for schools and the like. Ultimately network architecture could limit the risk, but no network is immune to MITM attack, especially with physical access. –  ewanm89 Sep 19 '12 at 20:54

4 Answers 4

up vote 3 down vote accepted

No. If the page and scripts were not delivered securely in the first place then there is always the possibility that a third party has modified the content. Securing the iframe is not sufficient, since the non-secured content could still contain malicious scripts.

Note that this doesn't mean that your information WILL be compromised if you use this login, merely that the possibility is there.

share|improve this answer
    
He said there wasn't a secure iframe, but as you pointed out it's still insecure if there is. –  ewanm89 Sep 19 '12 at 20:48
    
thanks, I know the question sucked, I will have to do some more research on this. –  November Sep 21 '12 at 23:08

A page without TLS (aka SSL) is not secure against eavesdroppers or Man-in-the-Middle attacks. I wouldn't give them any information I want to keep secret like credit card #s or passwords that I don't want to fall into the hands of an attacker. I will however say use dumb passwords for accounts that I don't worry about falling into the hands of an attacker (like a free account to read washington post articles).

Granted that doesn't mean any user on the network can always trivially to eavesdrop/launch a MitM attack. E.g., most LANs are set up in a star network topology, meaning that unless you have access to the central switch (typically only administrators or people working at an ISP), its not easy to eavesdrop in.

Granted say unencrypted wifi is different and makes it easy to eavesdrop. Even wifi with a broken security scheme like WEP or where you know the pre-shared key and observe the WPA handshake that generates the pairwise transient key.

share|improve this answer

Short answer: no, you can replace the javascript using a MITM attack with whatever code you want.

share|improve this answer

Ultimately no.

Though lots of charlatans would say if it posts to an SSL URL then it could be secure, this is flat out wrong:

  1. The user doesn't know it does this and to find out takes some element of skill.
  2. An active man in the middle can modify the page and/or JavaScript to no-longer post to a secure URL easily enough.
  3. JavaScript encryption is such a situation can't even start to be secure for the same reasons.
  4. If other pages also aren't encrypted after login it can't have the secure bit set on the cookie and therefore is vulnerable to session hijacking.
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.