Return to Question

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat Sheet, the password should be only transmitted over tls because of the following Statement:

"Failure to utilize TLS for the login landing page allows an attacker to modify the login form Action".

My first question is: whether the statement above is automatically implicit whenever the password is not transmitted over TLS/SSL. Because normally no TLS/SSL means there is no confidentiality, integrity and replay protection for this Password but I don't understand what the form Action has to do with it. a part from the fact that there is a possibility to view the Password some where.

My second question is: Is it possible in practice for an attacker to manipulate the login form? how can the attacker manipulate the login form if he has no access to the server data..? because for instance if the entire page is programmed in php, how could the attacker do that. could you give me an example. I hope to have be more precised.

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat Sheet, the password should be only transmitted over tls because of the following Statement:

"Failure to utilize TLS for the login landing page allows an attacker to modify the login form Action".

My first question is: whether the statement above is automatically implicit whenever the password is not transmitted over TLS/SSL. Because normally no TLS/SSL means there is no confidentiality, integrity and replay protection for this Password but I don't understand what the form Action has to do with it. a part from the fact that there is a possibility to view the Password some where.

My second question is: Is it possible in practice for an attacker to manipulate the login form? how can the attacker manipulate the login form if he has no access to the server data..? because for instance if the entire page is programmed in php, how could the attacker do that. could you give me an example. I hope to have be more precised.

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat Sheet, the password should be only transmitted over tls because of the following Statement:

"Failure to utilize TLS for the login landing page allows an attacker to modify the login form Action".

My first question is: whether the statement above is automatically implicit whenever the password is not transmitted over TLS/SSL. Because normally no TLS/SSL means there is no confidentiality, integrity and replay protection for this Password but I don't understand what the form Action has to do with it. a part from the fact that there is a possibility to view the Password some where.

My second question is: Is it possible in practice for an attacker to manipulate the login form? how can the attacker manipulate the login form if he has no access to the server data..? because for instance if the entire page is programmed in php, how could the attacker do that. could you give me an example. I hope to have be more precised.

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat Sheet, the password should be only transmitted over tls because of the following Statement:

"Failure to utilize TLS for the login landing page allows an attacker to modify the login form Action".

My first question is: whether the statement above is automatically implicit whenever the password is not transmitted over TLS/SSL. Because normally no TLS/SSL means there is no confidentiality, integrity and replay protection for this Password but I don't understand what the form Action has to do with it. a part from the fact that there is a possibility to view the Password some where.

My second question is: Is it possible in practice for an attacker to manipulate the login form? how can the attacker manipulate the login form if he has no access to the server data..? because for instance if the entire page is programmed in php, how could the attacker do that. could you give me an example. I hope to have be more precised.

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat Sheet, the password should be only transmitted over tls because of the following Statement:

"Failure to utilize TLS for the login landing page allows an attacker to modify the login form Action".

Now my first question is whether the statement above is automatically implicit whenever the password is not transmitted over TLS/SSL. Because normally no TLS/SSL means there is no confidentiality, integrity and replay protection for this Password but I don't understand what the form Action has to do with it. a part from the fact that there is a possibility to view the Password some where.

the second question: Is it possible in practice for an attacker to manipulate the login form? how can the attacker manipulate the login form if he has no access to the server data..? because for instance if the entire page is programmed in php, how could the attacker do that. could you give me an example. I hope to have be more precised.

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat Sheet, the password should be only transmitted over tls because of the following Statement:

"Failure to utilize TLS for the login landing page allows an attacker to modify the login form Action".

My first question is: whether the statement above is automatically implicit whenever the password is not transmitted over TLS/SSL. Because normally no TLS/SSL means there is no confidentiality, integrity and replay protection for this Password but I don't understand what the form Action has to do with it. a part from the fact that there is a possibility to view the Password some where.

My second question is: Is it possible in practice for an attacker to manipulate the login form? how can the attacker manipulate the login form if he has no access to the server data..? because for instance if the entire page is programmed in php, how could the attacker do that. could you give me an example. I hope to have be more precised.