So on a website I get this popup from Firefox:
I went ahead and asked the website about it and they say the login is very well submitted encrypted. Why do I still get the popup? Who's lying? How can I find out?
-
That is the warning behaviour which got introduced not too long ago to Firefox.– mvwFeb 6, 2018 at 14:50
-
chrome has it too I think– Journeyman Geek ♦Feb 7, 2018 at 2:02
-
I tried the same page in Chrome and Edge, neither of which warned about the form.– zedooFeb 7, 2018 at 13:28
-
And funnily, the website support told me to ask the Browser developers why they put false warnings in there.– zedooFeb 7, 2018 at 13:29
-
@zedoo Chrome's a bit more subtle, with a "not secure" up the top left. And of course the site will blame the browsers... not that it went well the last time. Can you share the site? I'd like to take a look to confirm.– BobFeb 7, 2018 at 13:47
|
Show 1 more comment
2 Answers
they say the login is very well submitted encrypted
That's not good enough. It doesn't matter if the login form is submitted to a HTTPS destination if the page the login form is shown on is not itself encrypted.
This is actually explained on Mozilla's own documentation.
I believe this is what you are seeing:
- Login form is displayed on a HTTP site
- Login form submit button goes to a HTTPS site
This is what is required to be secure:
- Login form is displayed on a HTTPS site
- Login form submit button goes to a HTTPS site
Another possibility is that they've embedded an HTTPS iframe inside a HTTP document, which runs into similar issues.
Why? Because the login form itself is not secured, there's nothing stopping an attacker from modifying said form. This means they can change the form and make it submit to a non-HTTPS site, or even another website entirely! They could also inject a script that captures your keypresses and sends them to an attacker-controlled site before you even submit the login.
Following this, Firefox will show the warning if the login form itself is detected on a non-HTTPS site, no matter what it's submitting to.
This is a very common issue and a lot of site operators (including sites you'd expect to be very secure, e.g. banks) don't seem to be aware (or just don't care). Troy Hunt has some great blog posts exploring this issue, dating back to five years ago. And of course it's still a common problem today.
The browser detects that the site is doing at least one of these things:
Not using https
The connection is only partially encrypted (websites with self-signed certificates or certificates that are not issued by a trusted authority).
Is using weak encryption.
The last two issues are cases where even using encryption, the connection is not strongly or fully encrypted, opening a door to eavesdropping or man-in-the-middle attacks.
You can go to ' More information' and check the encryption used:
And clicking on View Certificate you can see the details of the certificate used by the website:
