Re: Cahoot

"Brian L Johnson" <brian-aomQ0MJYmIRZut5cgo8xMlpr/1R2p/[email protected]> Wed, 06 May 2015 23:02:38 +0100

Newsgroups	gmane.law.cryptography.uk
Message-ID	<op.xx8h6ocsc3r7hz@thedell>

On Wed, 06 May 2015 17:41:20 +0100, Francis Davey <[email protected]> wrote:

> Thoughts? I am keen not to have my bank account hacked.

Apart from using weak crypto, the main issue appears to be that some  
elements of the page are insecure.

In Chrome's words:

"Your connection to the site is encrypted, but Google Chrome has detected  
mixed content on the page. Be careful if you're entering information on  
this page. Mixed content can provide a loophole for someone to manipulate  
the page. This content could be third- party images or ads embedded on the  
page."

So, if someone inserts an ad which is designed to look like the box where  
you enter your username and password...

-- 
brianlj