Entering sensitive information into non-SSL site that uses secure iFrame

Question

There is a website that tenants can use to pay their rent. That website uses an http address but apparently uses a third-party product, which embeds an iframe into the page. The source of that iframe is https and all forms within the page are within that iframe.

I'm wondering what are the security risks of this type of setup for the users.

I would also add that located on the bottom of every page is a "seal" from godaddy that you click on and it provides some security-related information about the iframe source.

My intuition says that is not ideal. For one thing, seeing the browser's address bar unable to provide identity/encryption information is disconcerting. Without viewing the source of the page, how do I know where the iframe content is from? Is relying on the godaddy seal sufficient?

Answer 1

I'm wondering what are the security risks of this type of setup for the users.

It's almost as bad as serving everything over plain HTTP.

You get protection against purely passive listening attacks, but really anyone in the position to do that kind of man-in-the-middle attack is very likely also to be able to do an active attack, changing the content that gets sent back to the browser. That could include changing the iframe src in the unprotected parent page, or injecting some attack script.

In practice the HTTPS-iframe gets you protection from a casual attacker sniffing general traffic, but for any man-in-the-middle targeting the site specifically it is trivial to make the measure ineffective.

It's up to the provider whether they think this barely-more-than-plain-HTTP assurance is suitable for the kind of information that will be entered into the frame - except if that information contains credit card data, in which case they have an obligation to abide by the PCI-DSS rules requiring HTTPS. (Assessors are expected to verify that HTTPS indicators are visible in the browser chrome.)

seeing the browser's address bar unable to provide identity/encryption information is disconcerting.

Yes - independently of the question of actual security, this is poor perceived-security and may put some users off.

Without viewing the source of the page, how do I know where the iframe content is from?

Quite. Viewing source/DOM isn't something you can expect a civilian to do.

Additionally, even if you verify the iframe is coming from HTTPS, there is nothing stopping the unsecured parent page from interfering with it with 'clickjacking' attacks, for example a keylogging overlay form.

Is relying on the godaddy seal sufficient?

Seals offer no security, as they are trivially spoofable. They are nothing but a marketing exercise; CAs should be ashamed of this deliberately misleading behaviour.

Answer 2

Mixing HTTP and HTTPs pretty much destroys most advantages of HTTPS. For one, an attacker could present you with a malicious parent HTTP frame, with the iframe linking to his own site. The browser wouldn't find it suspicious. Neither would the user. The iframe URL is hidden, and the iframe isn't claiming to be HTTP. Nobody would know the difference, unless they checked.

The "seal" is just an HTML element, easily forged. I don't know how it works, but it probably is just a link to a GoDaddy page with SSL certificate information. The malicious iframe can just use the same HTML and link to the same GoDaddy page. Or, they can display the security information in a different manner (within the iframe itself, etc), and those who don't know what the original authenticator looks like will never know the difference.