Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm writing a paper for class and one of the things I'm writing about is internet security. I know that SSL certificates can be easily obtained and are supposed to encrypt data on SSL certified pages.

I know that people experience issues with making their site fully secure even with purchasing SSL certification - so just because one page shows the SSL badge or has https protocol, doesn't mean that every page on that site is secure.

I'm going to present a hypothetical situation and reiterate my question to hopefully clarify what it is that I'm asking:

Suppose I go to a website that shows it's SSL secured. I click to create an account and the new user registration page also shows that its SSL secured. The login page is also SSL secured and I login to my new account. (so far everything has shown to be SSL secured). As I explore this website (logged in) some of the pages I go to DO NOT show the SSL emblem.

My question is: If I have only entered information that should be secured, on pages with SSL.. Does that guarantee that it's actually secure?

Additionally.. Does that information remain secure from the admin? Like can a site appear "secure" but be exposed vulnerabilities or be a mockery of SSL certificates?

Thanks!

share|improve this question

migrated from stackoverflow.com Dec 29 '13 at 8:04

This question came from our site for professional and enthusiast programmers.

    
not from admin , also if u r in some lan behind firewall ,the IT guy can use proxy and get your information .(Nothing is 100% secure). also some https(ssl)encryption algorithms were found vulnerable even for mitm –  Roma-MT Dec 20 '13 at 0:27
    
@jdigital I have, that's a good point. I know that companies such as Google have started implementing encryption on everything. Which has been causing more confusion regarding SSL - at least to me lol –  Justin Dec 20 '13 at 0:32
    
@user2957713 just because you are on a lan, behind a firewall, or using a proxy doesn't mean that IT guy can get read your stuff. In fact most of the time this isn't true. For that to work the IT guy would need a way to install a trusted root certificate on your machine. This is possible if the machine is part of something like an Active Directory, or some other management environment. But that doesn't happen on accident. –  Erick Dec 20 '13 at 0:56
    
Well,My IT guy just showed me his stuff (at work) he was making some proxy service (I dont remember the name of the program) and it revelaed all the ssl sesions like nothing in real time. –  Roma-MT Dec 20 '13 at 0:58
    
Because "at work" the client computer is likely under centralized management allowing IT to install their own trusted root certificates through a mechanism such as group policy. –  Erick Dec 20 '13 at 1:11

3 Answers 3

up vote 1 down vote accepted

The short answer is that it depends on the site.

SSL only encrypts the traffic in transit between a startpoint/endpoint and makes no assumptions about whether the data is secured at the origin or the destination. The site that you're browsing may do whatever they want with your information including displaying that sensitive information back to you while you're navigating the site via plain HTTP. If your sensitive data is sent as vanilla HTTP then naturally your data is susceptible to eaves dropping as well as man-in-the-middle attacks.

Also, as a security measure browsers will treat HTTP vs HTTPS as separate sites despite the domain name. However, sites can elect to allow cross communication (resource sharing) using CORS (and JSONP). That is, with CORS it may be possible for the HTTP version of the site to access/modify information on the HTTPS site. This is a concern since HTTP traffic may have been modified in transit by an attacker because it's not sent securely and hence cannot be trusted. An attacker could have modified the HTTP content to do anything they like including sending your sensitive data to another machine.

share|improve this answer

"Secured" is an overloaded non specific term.

SSL encrypts the connection between the server and client at the point in time that a connection is open. That means the data is encrypted while in transit between the client and server. It also provides cryptographic assurances that the certificate used to encrypt the connection was issued by a trusted certificate authority to an entity that has administrative control over the domain name in the address bar.

What happens after that is outside of the scope of SSL. So no, once you're done submitting your secure information via a form, there is no reason to believe that it would be secured from the admin.

Something else to consider:

Just because a form is on a page that is using SSL, doesn't mean the form submission itself is secured with SSL. The html form tag has an action attribute which points to a url on the server. The value on the action attribute can be setup in a 1 of 3 ways.

  1. Use SSL if the containing page is using ssl. Don't use ssl if the containing page is not using ssl. An action attribute of this type would take the form of action="/formprocessor"

  2. Always use ssl regardless of the containing page this would look like action="https://example.com/formprocessor"

  3. Never use ssl, regardless of the contaning page. This would look like action=http://example.com/formprocessor"

share|improve this answer

Do you mean guarantee security or guarantee encryption?

If you mean the former, then the answer is no.

The site could still be vulnerable to lots of attacks such as XSS, CSRF, SQL Injection, etc, regardless of its HTTPS status.

If you mean the latter, then the answer is also no. Even though the login form, the page it submits to (action="https://www.example.com/dologin") and every page that displays your personal details are accessed over HTTPS, if the authentication cookie hasn't had the secure flag set then the value could be leaked over an unencrypted HTTP connection (e.g. if the "about us" page has a HTTP URL). The token contained in this cookie could be intercepted by a Man In The Middle which could lead to Session Hijacking by a third party.

This would also be possible if there were no HTTP only pages accessed once logged in. Say if you visit a forum site, a user of the forum could have posted an external image with the URL http://www.example.com/fake_image.jpg which would force your cookie value to be leaked over the unencrypted connection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.