Cable Forum - Unsecure form on https?

Cable Forum (https://www.cableforum.uk/board/index.php)

- Internet Discussion (https://www.cableforum.uk/board/forumdisplay.php?f=25)

- - Unsecure form on https? (https://www.cableforum.uk/board/showthread.php?t=14728)

Re: Unsecure form on https?

Quote:

Originally Posted by greencreeper

It's the fact folks keep referring to "secure and insecure pages", of which there are no such thing, that's confusing matters. The request for the page and the reponse from the server to that request are secure, not the page. The little lock symbol says "this page got here over a secure connection" not "this page is secure".

Well true, but it makes it easier to explain. :p:

Re: Unsecure form on https?

But is that POST command being sent back over the secure connection, then the next page loaded insecurly, are both on an insecure connection?

Re: Unsecure form on https?

Quote:

Originally Posted by Richard M

Well true, but it makes is easier to explain. :p:

Does it though? Once terminology starts drifting, understanding tends to do likewise :)

Re: Unsecure form on https?

Quote:

Originally Posted by SMHarman

But is that POST command being sent back over the secure connection, then the next page loaded insecurly, are both on an insecure connection?

No, because it's the same as clicking a link like http://www.google.co.uk/ from a page displayed over SSL - it doesn't make Google be transmitted securely.

Re: Unsecure form on https?

Quote:

Originally Posted by SMHarman

But is that POST command being sent back over the secure connection, then the next page loaded insecurly, are both on an insecure connection?

No - the current page, with the lock symbol and the HTTPS URL, got to the browser securely. The request and response (which sent back the page) were over a secure connection. Once the browser receives the response, the connection ends. When the form is submitted, that's a POST request over a HTTP connection, to which there will be a response, also over a HTTP connection, which will be the confirmation page.

Re: Unsecure form on https?

This query all came about because I was trying to set up a client with a new ISP. I selected Vispa because they are recommended on ispreview, they offer a business service that matches our requirements at a reasonable price and they are local.

First they couldn't provide a printed contract for my client to sign. Instead I had to register for them using the Vispa web site. Then I discover that payment has to be made through a credit card. My client does not have a business credit card. Eventually I am told that I can request the forms to set up a direct debit but I must have an account first. I can only create this through their web site using a credit card. My solution was to bill it to my personal card and then invoice my client until the direct debit was effective. That's how I found myself at the problem I described at the beginning of this thread. The saga continues thus:

Quote:

On Tue, 6 Jul 2004 16:24:52 +0100, xxxx@ntlworld.com wrote:
mmmm....

Sign up (giving my credit card details) through an unsecure web form?

Think again boys!

regards
James

Quote:

From: <sales@vispa.net>
To: <xxxx@ntlworld.com>
Sent: Saturday, July 10, 2004 11:47 AM

James,

There is nothing unsecure about our web form. It's encrypted at 128k directly
into our secure transaction server.
The decision to down to yourself, however it's not been a problem for our
40,000 other customers.

Martin
Vispa Internet Limited
http://www.vispa.net

Quote:

On Mon, 12 Jul 2004 15:19:44 +0100, xxxxx@ntlworld.com wrote:
Hi Martin

40,000 people can't be wrong can they?

A quote from your signup page:
<form method="POST" action="http://secure.vispaconnect.co.uk/broadband/y-step6.php">

Shouldn't that read action="https://......"?

If you would like me to call you by phone to set up an account then please
supply an ordinary, geographic, phone number - not a premium rate 0870
one.

regards
James

Quote:

From: <sales@vispa.net>
To: <xxxxx@ntlworld.com>
Sent: Monday, July 12, 2004 4:43 PM

James,

I will refer this to a developer.

PS: 0870 is not premium...that's an 09 number
0870 are national rate, you pay the same rate regardless of distance at
national rates (over 35 miles).

Martin
Vispa Internet Limited
http://www.vispa.net

Quote:

> On Mon, 12 Jul 2004 18:11:32 +0100, xxxxx@ntlworld.com wrote:
Hi Martin

FYI I pay the following prices (inc VAT) for my calls:

to geographic numbers (like 0161):
daytime - 3p per minute
evenings - flat 5.5p for up to 60 minutes
weekends - flat 5.5p for up to 60 minutes

to 08701 624 888
daytime - 7.509p per minute (more than 2.5 times the cost)
evenings - 3.749p per minute
weekends - 1.5p per minute

For many people (for example those on BT's Together Option 3 tariff) the
difference is even greater.

Although your number is not what BT describe as a 'Premium Rate Service', it
certainly costs me much more to call you on this number than it would on an
0161
number. Therefore I feel quite justified in describing your number as
premium
rate.

regards
James

Quote:

From: <sales@vispa.net>
To: <xxxxx@ntlworld.com>
Sent: Monday, July 12, 2004 6:32 PM

James,

Then our services are not for you.

Martin
Vispa Internet Limited
http://www.vispa.net

Well they can't say I didn't try!

Re: Unsecure form on https?

I like the bit "I will refer this to a developer" :D Meaning that until you told him otherwise he was ignorant to the fact that his company had put 40,000 people at risk of having their credit card details intercepted :D

Re: Unsecure form on https?

Quote:

Originally Posted by altis

Hope you've posted this up on isp preview, so some of the next few thousand customers can see what their customer service can be like.

Re: Unsecure form on https?

Quote:

Originally Posted by SMHarman

Hope you've posted this up on isp preview, so some of the next few thousand customers can see what their customer service can be like.

Good idea. :tu: