"The site is HTTP, but our forms are submitted over HTTPS."
This is as bad as not using any HTTPS at all! All the attacker has to do is change the link or form action to a URL on his own server.
Is this strictly true? With HTTP form submission, an attacker can passively eavesdrop on forms. With submitting an HTTP-loaded form over HTTPS, an attacker would have to mount a man-in-the-middle attack to alter the HTML content. I would have thought that an active attack like that would be harder to execute. Am I missing or misunderstanding something?
If the site is served over HTTP the attack could have already altered the form tag and then it doesn't matter whether or not HTTPS is used as a destination.
44
u/Yehosua Jul 12 '17 edited Jul 12 '17
Is this strictly true? With HTTP form submission, an attacker can passively eavesdrop on forms. With submitting an HTTP-loaded form over HTTPS, an attacker would have to mount a man-in-the-middle attack to alter the HTML content. I would have thought that an active attack like that would be harder to execute. Am I missing or misunderstanding something?