Unfortunately I cant link to the page (it internal). But I can describe it!

This is a lightspeed systems policy enforcement login page (content filter).

The page is http and there is no iframe with ssl. The login form posts to a javascript function.

So here is my question:

Could this page be secure and if so how?

  • 2
    How fast is this car? I can't describe it but it's read and has black tires. It's streamlined. Sep 19, 2012 at 20:42
  • ok, its not the best question. But is does address a point: is a page secure without SSL?
    – November
    Sep 19, 2012 at 20:43
  • Secure against what? What is the environment, what are the threats, what other countermeasures are in place? Sep 19, 2012 at 20:49
  • From what I can make out, Lightspeed Systems produce captive portal login systems for schools and the like. Ultimately network architecture could limit the risk, but no network is immune to MITM attack, especially with physical access.
    – ewanm89
    Sep 19, 2012 at 20:54

4 Answers 4


No. If the page and scripts were not delivered securely in the first place then there is always the possibility that a third party has modified the content. Securing the iframe is not sufficient, since the non-secured content could still contain malicious scripts.

Note that this doesn't mean that your information WILL be compromised if you use this login, merely that the possibility is there.

  • He said there wasn't a secure iframe, but as you pointed out it's still insecure if there is.
    – ewanm89
    Sep 19, 2012 at 20:48
  • thanks, I know the question sucked, I will have to do some more research on this.
    – November
    Sep 21, 2012 at 23:08

Short answer: no, you can replace the javascript using a MITM attack with whatever code you want.


Ultimately no.

Though lots of charlatans would say if it posts to an SSL URL then it could be secure, this is flat out wrong:

  1. The user doesn't know it does this and to find out takes some element of skill.
  2. An active man in the middle can modify the page and/or JavaScript to no-longer post to a secure URL easily enough.
  3. JavaScript encryption is such a situation can't even start to be secure for the same reasons.
  4. If other pages also aren't encrypted after login it can't have the secure bit set on the cookie and therefore is vulnerable to session hijacking.

A page without TLS (aka SSL) is not secure against eavesdroppers or Man-in-the-Middle attacks. I wouldn't give them any information I want to keep secret like credit card #s or passwords that I don't want to fall into the hands of an attacker. I will however say use dumb passwords for accounts that I don't worry about falling into the hands of an attacker (like a free account to read washington post articles).

Granted that doesn't mean any user on the network can always trivially to eavesdrop/launch a MitM attack. E.g., most LANs are set up in a star network topology, meaning that unless you have access to the central switch (typically only administrators or people working at an ISP), its not easy to eavesdrop in.

Granted say unencrypted wifi is different and makes it easy to eavesdrop. Even wifi with a broken security scheme like WEP or where you know the pre-shared key and observe the WPA handshake that generates the pairwise transient key.

Not the answer you're looking for? Browse other questions tagged .