How to ensure HTTPS is used to send credentials?

Question

As a user, how do I know my user name and password sent to a server is encrypted with HTTPS? Let me preempt the answer of "look for the little lock" or "look for https in the URL" with the following two examples:

First, let's say I browse to bank.com's website. When I get to the login page, the URL in the address bar says "https://www.bank.com/login.php". I type in the my user name and password, and hit submit.

However, the form for the authentication says this:

<form action="http://www.bank.com/login.php"> ... </form>

Obviously, my credentials are not being sent through HTTPS. The second example is just the opposite, as you might imagine. I browse to bank.com and am presented with the "http://www.bank.com/login.php" page. However, the form this time uses HTTPS:

<form action="https://www.bank.com/login.php"> ... </form>

From this, it's clear we can't trust the lock symbol in the browser nor the "https" in the address bar.

I think I really have two questions which straddle SO and SU:

1. SU: How can a normal (not HTML/programming savvy) user perform such a check effectively?
2. SO: How can websites (or browsers) provide help to users to perform this check?

Answer 1

1. For non-tech savvy users, there is not a lot you can do. Enabling warnings in your browser for posting over HTTP from HTTPS, is your best option. If available this is likely enabled by default. However, it it common that the form will not specify the site or protocol, and will submit back to the server which sent the form using the site and protocol that the form was supplied on. In this case, if the form was served over HTTPS, then the submission will be also.
2. Websites should run certification tests which ensure the login form requires HTTPS. This is relatively easy to do in most web servers. If they deal with credit cards, there are requirements that they do certify there site and infrastructure. They should also ensure the login form is only served using HTTPS.

HTTPS does not necessarily indicate that your data is well encrypted. There are relatively low security protocols which can be enabled. The server, and browser negotiate the encryption level. Where permitted (some countries have limits) you can disable lower security protocols in your browser. (The screen to do this is not always easy to find.) It is usually easier to check the security on the particular connection.

Answer 2

it's clear we can't trust the lock symbol in the browser nor the "https" in the address bar

Yes, you can. Because if a form on a HTTPS site submits to a non-HTTPS URL (your first example) then a sane browser will warn you.

So, for the best user experience the login page itself should indeed be served by HTTPS as well. Any bank will do that. On sites that don't, users indeed need to do the validation themselves, or install a plugin or use some Greasemonkey script to decorate safe forms.

Answer 3

Force-TLS requires you to specifiy sites you want to require https communications. An article on usage and why is here: http://techcrunch.com/2010/10/25/firesheep/ I think this might answer both questions