 NoVA_CoxUserStand back from the cage -- The RF bitesPremium
join:2004-07-06
Alexandria, VA
4 edits | reply to pbvan
Re: [ALL] Wash Post criticizes Cox over email securitysaid by pbvan: ... when logging into cox.net, the » page is where I log into for my email accounts. The actual page showing my email boxes is » . I think you might find the explanation provided in the following page helpful: »www.michaelhorowitz.com/securesubmit.html
To summarize:
1) Just because the page where you enter personal info is SSL-secured, doesn't mean that your personal info will be (or won't be) SSL-secured in-transmission when you click "login" ...
... It CAN however give you some assurance that the page which you are viewing is "genuine" if you verify the certificate's name and signing chain -- in other words, just because you have an SSL connection to a site doesn't necessarily mean that it's to the site to which you mean to be SSL-connected.
What IS important is whether the code underlying the "login" button is "http" or "https". (explained in the "Bad News" section in the earlier link)
2) Similarly, just because the "post-login" pages you receive from a site aren't SSL-secured, doesn't necessarily mean that your UID/Password was transmitted "in the clear"
Our own DSLR "SSL Log in" is one such example:
While your actual username/password are SSL-secured when transmitted ... specifically by this section of the page ...
FORM ACTION="https://secure.dslreports.com/r3/login"
Unfortunately, Cox's webmail authentication is only insecure, so regardless of what page you're reaching it from, your username/password is always transmitted "in the clear." |
