Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite

Suppose that i do a login to a website.

When i type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can capture the password?

how this can be avoided? thanks

share|improve this question

1 Answer

up vote 6 down vote accepted

https is designed to prevent this kind of attack: The communication between you and the server is encrypted. The server will provide a certificate to ensure that it is the correct one and not a man in the middle.. If the certificate is signed by an certification authority trusted by your browser, the connection will be accepted automatically. Otherwise you will get a warning about an untrusted certificate. If you are in doubt, don't click it away.

There is really no excuse not to use https for login, as simple trusted certificates are really cheap or free of charge. https should be used for everything, but some huge sites argue that it uses too much processing power.

share|improve this answer
then, i can capture a password if the facebook login is made in http? – Fel Jul 1 '11 at 12:00
1  
yes, if you can trick a user into using http instead of the default https for the login (e. g. if he goes to the http version of the start page and you manipulate the login form not to point to https://www.facebook.com/login.php?login_attempt=1) – Hendrik Brummermann♦ Jul 1 '11 at 13:23
ok, thank you :) – Fel Jul 1 '11 at 13:23
where can you get a reliable certificate that is free??? – Justin C Jul 1 '11 at 15:39
@Justin - Check with your hosting provider or service provider. Some offer a certian number of free certs. – Chad Jul 1 '11 at 16:09
show 8 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.