Timeline for TLS/SSL and password transmission
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 16, 2020 at 0:26 | history | edited | atk | CC BY-SA 4.0 |
deleted 73 characters in body
|
| Dec 10, 2014 at 18:50 | history | edited | atk | CC BY-SA 3.0 |
added 339 characters in body
|
| Dec 10, 2014 at 18:46 | comment | added | atk | @user2313067 good point. I will update my answer. I still think they could be clearer with how they explain this common misconception :-) | |
| Dec 10, 2014 at 17:35 | comment | added | user2313067 | I think that OWASP is indicating here that by setting https in the action of the formon an http page, you have no guarantee that the client will receive it unmodified, and it might point to a page the attacker controls. Putting https on subsequent pages but not on the login form only protects you against passive attacks. | |
| Dec 10, 2014 at 5:00 | vote | accept | user4237435 | ||
| Dec 10, 2014 at 4:08 | history | answered | atk | CC BY-SA 3.0 |