Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a security, SSL question about http://discovercard.com/

When you first go to Discover Card's Home Page you are able to type in your user name and password without the website being protected by SSL. When you hit login the information is passed over SSL but the home page does not use SSL itself.

Why do you think Discover does this? Is this fine to do? Are there any security risks by doing this?

Any other bank or credit card website I have gone to has SSL anywhere you type the username and password.

Thanks for the comments!

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Most sites don't do this because, in theory, a Man-in-the-Middle attack could be used to spoof the non-HTTPS login page so that the login information can be intercepted.

Though, in practice a MitM attack is a very rare and sophisticated attack. Unless you're on an unsecured network, there's almost no chance of it happening. And if you were to be victim to a MitM attack, I'm not even sure using an HTTPS login page would help. (There have been reports of rogue CA certificates being created by exploiting the use of the obsolete MD5 algorithm by root CAs; as well as stories of wildcard certificates being generated that can be used on any FQDN.)

That said, if SSL is secure (hopefully those exploits have been fixed), then the customer should be safe from MITM attacks if they're using an up-to-date browser and pay attention to browser warnings (sort of a big "if" considering many big sites don't even bother to use proper SSL certificates). And users do feel safer when they see the little lock icon on their browser, so that may be a good enough reason to use it, as there are few downsides to using HTTPS on the login page. The slowdown should be negligible considering the overhead of SSL encryption is minuscule compared to database or scripting overhead on most applications.

share|improve this answer
    
Thank you very much! That is the answer I was looking for! –  Jeff Dec 7 '10 at 14:04
add comment

Yes, I can assure you that http://discovercard.com/ is secured. Why? Well, please check http://discovercard.com carefully. Just before you hit the "login" button, please check the "Login" button thoroughly. On the status bar, you will see that when you click on this button, it will redirect your request to a secure HTTPS protocol.

As of this, I can ensure that this portal is safe and secure.

Why http://discovercard.com/ do all this? Well, if you run your site all in HTTPS protocol, your site will load slower than the ordinary site. Please remember that you will only have to protect your site when some credential informations is entered, not to the entire site. If a visitor comes to your site just for browsing, he does not need a secured channel. In fact, he may leave if he knows that your site loads slower due to the existense of the SSL.

Hope this helps :-)

share|improve this answer
    
Thank you for your answer. I do realize that when you hit the login button that it takes you to a https website. From the question: "When you hit login the information is passed over SSL but the home page does not use SSL itself." My question is then why do all the other banking websites do this?? bankofamerica.com www.chase.com etc... ?? –  Jeff Dec 6 '10 at 21:18
    
I believe I have addressed this queston before. If all the entire site is HTTPS protected, the loading time will be slower. I am sure you will not be happy with a slower site. –  user3688 Dec 7 '10 at 1:31
    
Again I realize that the site will be a little bit slower, not really what I am getting at. I am not saying the whole site should be protected by SSL only the portions that you are able to enter your user name and password. And btw again look at bankofamerica.com most of the site is protected with SSL and I have never had a speed problem with them! –  Jeff Dec 7 '10 at 5:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.