How can an https web site still be nonsecure?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

I read several months ago, in an article on some of the "worst" spyware out there, that it's possible for spyware to read https information, by installing itself in the browser between the browser and the SSL layer. (Unfortunately, I didn't save a link to the online version.)

Basically, the browser communicates internally with the SSL layer unencrypted. By wedging itself in that layer, the spyware can see everything unencrypted.

Have you heard anything of this?

yes leo, as you kind of alluded to, you can "view" "source" and read the html for where the link is pointed to but you just about have to have atleast some knowledge of html, like us geeks...lol

Great explanation! I never fully realized that it was the target page that really mattered, not the current page.

Hi Leo, I am a high school student. I am familiar with html but I was wondering is there a way of creating an online database that can be accessed by anyone using HTLM only. If so what are the necessary steps in doing so. And if not is there a way of creating and online database using other methods eg PHP, XHTML etc. And what would be the necessary steps.

Great article Leo ,you explained http/https method in details with extra information and solutions , really great article for beginners and professionals....thanks Leo.

You've done it again! Not only made the subject clear and understandable, but gave easy to follow instructions that even a senior citizen can follow.
Thanks - I feel safer now - for a while.

Thanks Leo. That was enlightening (as always).
Thanks a lot.

Agaian, a great topic, well explained.
Thank you

Since hovering over the 'Login' didn't work, I tried entering a fake username and password. Clicking 'Login' gave me an unknown user/password message but the URL started 'https' - could this be an easy way to verify the URL of the target page?

I don't know of a better way to get info to you and it may be important. In your News letter just below the link to this article I found this: MailScanner has detected a possible fraud attempt from "clicks.aweber.com" claiming to be http://www.ThisIsTrue.com. "MailScanner has detected a possible fraud attempt from "clicks.aweber.com" claiming to be" was in RED. I think I have MailScanner on my computer so I think this may be bad. I won't click on it unless you can say nothing to worry about. More information would be appreciated.

To post a comment on "How can an https web site still be nonsecure?", please return to that article's main page.