On Fri, Jul 09, 2010 at 01:34:26AM +0200, Floor Terra wrote:
quoted text
> > I admit that I'm a bit ignorant here, as I've myself never
> > administered an SSL web site, but I am not convinced by this: Doesn't
> > the above just mean that it switches to HTTPS *after* transmitting my
> > information in the clear? Or can someone else explain if and/or how
> > the above is sane?
> >
> 
> From a quick glance at the website:
> You get an empty form delivered over plain http. The form submits to
> an https page.
> This means the content of the form is only transmitted over https.
 
Unless the attacker substitutes the page with another one that can send
your password wherever he wants...