Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I see a login form that's not using HTTPS (it only diplays http:// in the URL) how can I determine if this request is forwarded to a secure server?

share|improve this question
1  
What do you mean by a "secure server"? If you're not using HTTPS, you're not over a secure connection. –  heavyd Dec 19 '13 at 16:58
    
While @arco444 answer is good and correct, you should assume its not secure - even if it is posting to HTTPS as the request could be rewritten to someone elses HTTPS server, ie the system could already be compromised. Moxy Marlinspike has done in depth talks about subverting https, and it would be relatively trivial to attack this. –  davidgo Dec 19 '13 at 18:00
    
@davidgo, thank you for your answer. Please convert your comment to an answer and I'll accept it. –  prmths Jan 13 at 12:51
    
Thank you, done. –  davidgo Jan 13 at 17:32
add comment

2 Answers 2

up vote 1 down vote accepted

Expanding on the comment of @arco444, you should assume its not secure - even if it is posting to HTTPS as the request could be rewritten to someone elses server, ie the system could already be compromised. Moxy Marlinspike has done in depth talks about subverting https, and it would be relatively trivial to attack this.

share|improve this answer
add comment

I assume you're referring to the form action, and whether this does a POST or similar to https.

You could view the page source, there's a chance the destination will be in the "action" parameter if the form is in html, though a lot of sites are unlikely to use this method.

In that case, use Firebug or Chrome developer tools and select the network tab, put some dummy data in the form and submit it, and look at the resulting requests your browser makes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.