This is a bad idea...

re: This is a bad idea...

Thu, 05 Aug 2004 23:14:00 GMT

My credit union has the same thing on their site. (www.octfcu.org) They have the same disclaimer button, and similar language in their explanation. I wonder if it was done by the same company... I agree, very bad practice.

re: This is a bad idea...

Jerry Pisk — Thu, 05 Aug 2004 23:35:00 GMT

Technically they're right. When your input page loads over SSL it doesn't mean jack. What's important is how it's submitted and I'm sure most people would not even know that their credentials are sent clear text if the submit would go over HTTP, without SSL, because everybody I know has those switch notifications off. So they would think they're sending their data over secure connection even when they would not, because the input page had a lock.

re: This is a bad idea...

Franci Penov — Thu, 05 Aug 2004 23:45:00 GMT

That is correct. It's possible to have https page that submits the user data in clear text. As it is possible to submit encrypted data from unsecured page.

But that's hardly the point. The point is that it's a bad idea to train your customers to rely on what the content of the page says about the underlying connection security. The same content (i.e. lock icon) can mean totally different thing on another page.

People are very gullible. They should be trained to be more suspicious, not less.

re: This is a bad idea...

drebin — Thu, 05 Aug 2004 23:51:00 GMT

I work for a brokerage firm - when we wrote our online service (around 1999-2000) - we did this too. It ended up being a HUGE point of contention between IT and Marketing..

The marketing people said "We want a login/password right from the dub-dub-dub site! Period." and we said, "Well, you can't.. not really. Either [use the technique above] which is bad practice.. or make the main www site be https - which makes the whole site much slower".. No matter how you slice it, if you want a login box from the main www site, it's going to be not pretty.

We explained that this technique (above) was not very good - but the marketeers won after all. We have MANY screaming arguments in the board room. They pretty much pulled rank and we HAD to do it.

In the end, it didn't matter because we outsourced the back-end of our business and the product we took 1.5 years to build was only used for about 8 months before it was replaced! :-)

Point is, you Microsoft folks need to get out more.. there is a WHOLE LOT MORE to programming than this very academic viewpoint you guys have. No offense. :-) but corporate politics and deadlines often make us do LOTS of things we wouldn't normally do sitting in a classroom.

re: This is a bad idea...

Doug Lawty — Fri, 06 Aug 2004 03:30:00 GMT

But what would be a better practice?

I agree that the content of the page can easily mislead a user and we shouldn't be encouraging them to trust that.

However, teaching them to look for the lock present on the login form can be just as misleading.

Since the browser doesn't indicate whether or not the post will happen over an SSL connection, there's nothing on the login form that can be trusted for guidance.

Should we teach users to view the source and look at the action of the <form> tag?

Credit Union puts login area on an unsecure page

Lockergnome's Web Developers — Fri, 06 Aug 2004 08:05:00 GMT

FirstTech Credit Union may understand the importance of banking security, however they seem to be struggling with the obvious implementation of such. First they put the login area on unsecured page, then they come up with some crazy explanation as...

An even worse idea

gfox — Fri, 06 Aug 2004 16:20:00 GMT

I wanted to log into a website that holds information about my truck loan. The login is an insecure page. They required my Social Insurance Number (much like the SSN in the USA) as an identifier. In Canada it is illegal to identify people by their SIN, unless they expressly permit it.

So, the INsecure website is asking for a very important number that can be very damaging ifit got into the wrong hands, and they are doign it illegally. The best part is when you submit the form (I managed to find a secure version buried in the bowels of their site), a javascript popup displays basically stating that by submitting your SIN you agree to allow them to use your SIN to identify you. What kind of backass way of doing things is this?