NoVA_CoxUser
Stand back from the cage -- The RF bites
Premium
join:2004-07-06
Alexandria, VA
 ·Cox HSI
4 edits | reply to pbvan
Re: [ALL] Wash Post criticizes Cox over email security
said by pbvan  : ... when logging into cox.net, the » https:// page is where I log into for my email accounts. The actual page showing my email boxes is » . I think you might find the explanation provided in the following page helpful: »www.michaelhorowitz.com/securesubmit.html
To summarize:
1) Just because the page where you enter personal info is SSL-secured, doesn't mean that your personal info will be (or won't be) SSL-secured in-transmission when you click "login" ...
... It CAN however give you some assurance that the page which you are viewing is "genuine" if you verify the certificate's name and signing chain -- in other words, just because you have an SSL connection to a site doesn't necessarily mean that it's to the site to which you mean to be SSL-connected.
What IS important is whether the code underlying the "login" button is "http" or "https". (explained in the "Bad News" section in the earlier link)
2) Similarly, just because the "post-login" pages you receive from a site aren't SSL-secured, doesn't necessarily mean that your UID/Password was transmitted "in the clear"
Our own DSLR "SSL Log in" is one such example:
While your actual username/password are SSL-secured when transmitted ... specifically by this section of the page ...
FORM ACTION="https://secure.dslreports.com/r3/login"
Unfortunately, Cox's webmail authentication is only insecure, so regardless of what page you're reaching it from, your username/password is always transmitted "in the clear." |
