Saturday, January 28. 2006
re: Secure Logins (fun with Greasemonkey)
Chris posted about Secure Logins, last week. In it, he describes the confusion that exists when users cross from HTTP to HTTPS via forms.
Chris isn't alone in noticing this problem. A few weeks ago, on the Security Now! podcast, Steve Gibson answered a user question about the same problem.
On Chris' blog, I mentioned that this would be a good use for Greasemonkey. (If you don't know about Greasemonkey, you should definitely check it out.)
Since then, I've had two flights, and took a little time to work out a solution to the problem.
When hovering a form button, image or submit input, you'll see a description of the form's action, and various potential problems (onsubmit, onclick, etc).
It doesn't solve all "hijacking" problems, but it's not supposed to.. it's just a quick indicator of where your form probably posts.
Even if you're not interested, take a look at the source for a cool little embedded image trick.
Enjoy.
S
Chris isn't alone in noticing this problem. A few weeks ago, on the Security Now! podcast, Steve Gibson answered a user question about the same problem.
On Chris' blog, I mentioned that this would be a good use for Greasemonkey. (If you don't know about Greasemonkey, you should definitely check it out.)
Since then, I've had two flights, and took a little time to work out a solution to the problem.
When hovering a form button, image or submit input, you'll see a description of the form's action, and various potential problems (onsubmit, onclick, etc).
It doesn't solve all "hijacking" problems, but it's not supposed to.. it's just a quick indicator of where your form probably posts.
Even if you're not interested, take a look at the source for a cool little embedded image trick.
Enjoy.
S
Trackbacks
Trackback specific URI for this entry
No Trackbacks
Comments
Display comments as
(Linear | Threaded)
very nice!
Doesn't always work, though, for example it doesn't pop up in gmail on the majority of the buttons. Probably has something to do with the fact that they're dynamically created - didn't have time to verify.
Best regards
Doesn't always work, though, for example it doesn't pop up in gmail on the majority of the buttons. Probably has something to do with the fact that they're dynamically created - didn't have time to verify.
Best regards
You're right; it doesn't work with most of the gmail buttons. I suspect your hypothesis about auto-generation is also correct, but I'm not sure. Feel free to send a patch (-;
S
S
Sean, thanks for the valuable and inspired script. I've modified mine so that it displays a greyed-out "unlocked" lock when the form isn't secure. To me, it seems better to positively indicate an insecure form with that graphic than to negatively indicate it with the absence of the lock.
One thing I've noticed is that insecure forms embedded in pages that have been called via SSL are labelled as secure, probably because your code assigns the secure label if the document.location contains https. What was your reason for doing this?
One thing I've noticed is that insecure forms embedded in pages that have been called via SSL are labelled as secure, probably because your code assigns the secure label if the document.location contains https. What was your reason for doing this?
QUOTE:
insecure forms embedded in pages that have been called via SSL are labelled as secure
Do you have an example of this? I'm not sure what you mean.
S
Sure. Go to https://www.mystockoptions.com/ and mouseover the "Go" button of the search form in the upper left. Even though the form action is fully-qualified with http://, the script shows a lock icon because it reads the https in the document.location.href.
Nice catch. I tried to check for this, but I ended up with a logic error.
The script has been updated; it should work fine now.
Let me know if not.
S
The script has been updated; it should work fine now.
Let me know if not.
S
i've used a Firefox-Plugin quite a while, which exactly does wht you propose:
https://addons.mozilla.org/firefox/1579/
M.
https://addons.mozilla.org/firefox/1579/
M.
Just found this script and I like it better than the Firefox plugin posted by M.
There is a problem with the indicator appearing underneath the submit buttons on some pages (e.g. Search on Wikipedia), so I added a couple CSS fixes to the script.
Just add a new style for each of the lockDivBG and lockDiv elements:
I also added a focus and blur event listener, so you can just tab to the submit button and not have to hover over it with the mouse. Add these two lines under the other addEventListeners in the assign_events function:
Hope someone finds this helpful. Thanks for the script, Sean!
-Aaron
There is a problem with the indicator appearing underneath the submit buttons on some pages (e.g. Search on Wikipedia), so I added a couple CSS fixes to the script.
Just add a new style for each of the lockDivBG and lockDiv elements:
CODE:
lockDivBG.style.zIndex=1000;
lockDiv.style.zIndex=1000;
lockDiv.style.zIndex=1000;
I also added a focus and blur event listener, so you can just tab to the submit button and not have to hover over it with the mouse. Add these two lines under the other addEventListeners in the assign_events function:
CODE:
xpath_results[n].addEventListener('blur', roll_out, true);
xpath_results[n].addEventListener('focus', show_overlay, true);
xpath_results[n].addEventListener('focus', show_overlay, true);
Hope someone finds this helpful. Thanks for the script, Sean!
-Aaron
Pay the bills...
Calendar
|
August '08 | |||||
| Mon | Tue | Wed | Thu | Fri | Sat | Sun |
| 1 | 2 | 3 | ||||
| 4 | 5 | 6 | 7 | 8 | 9 | 10 |
| 11 | 12 | 13 | 14 | 15 | 16 | 17 |
| 18 | 19 | 20 | 21 | 22 | 23 | 24 |
| 25 | 26 | 27 | 28 | 29 | 30 | 31 |
Quicksearch
Archives
Syndicate This Blog
My PERSONAL Blog
Note:
The contents of this blog are my own, PERSONAL opinion and do not represent the thoughts or opinions of the people I work with or for. If you have a beef with something I said, take it up with ME. Thanks (-:
The contents of this blog are my own, PERSONAL opinion and do not represent the thoughts or opinions of the people I work with or for. If you have a beef with something I said, take it up with ME. Thanks (-:
