canmove, Confirmed users
285
edits
Security/Features/Identify which bits are unencrypted: Difference between revisions
Security/Features/Identify which bits are unencrypted (view source)
Revision as of 00:37, 5 April 2012
, 5 April 2012no edit summary
No edit summary |
No edit summary |
||
| Line 9: | Line 9: | ||
{{FeaturePageBody | {{FeaturePageBody | ||
|Feature overview=Highlight passwords and other sensitive data that is not transmitted over ssl. For the first stage, we will focus on type=password | |Feature overview=Highlight passwords and other sensitive data that is not transmitted over ssl. For the first stage, we will focus on type=password | ||
|Feature users and use cases=* A user is asked to login on an http page. The login form submits to an http destination. Users password is sent in cleartext. | |||
* A user is asked to login on an https page. The login form submits to an http destination. Users password is sent in cleartext. | |||
* A user is asked to login on an http page. The login form submits to an https destination. An attacker can mitm the first request to the login page and replace the form with one that submits the password to the attackers webpage instead. | |||
|Feature requirements=When type=password, outline the password box in red. Also add a note to the user that occurs onfocus so they know why the form is outlined in red (perhaps utilizing Constraint Validation) | |||
}} | }} | ||
{{FeatureInfo | {{FeatureInfo | ||