From HTTP to HTTPS, the sooner the better?

Question

If I have this page in "http://example.com/login" with GET verb:

<form action="https://example.com/login" method="post">
   <input type="text" name="login"/>
   <input type="password" name="pass"/>
   <input type="submit" value="Login"/>
</form>

Is it a security flaw? I mean, the page is HTTP but when sending the data it uses HTTPS. I have read several times that I should require HTTPS already in the login page, but I don't clearly see why.

Answer 1

Yes, it's flawed. What you have is secure as far as it goes, as long as it's your login form the user is seeing.

Because your login form isn't secured, I can come along and substitute my own spoof login form and collect your users' login details, eg. via a man-in-the-middle attack. A login system is only secure if both the login form and the target page use SSL.

Also, it doesn't look secure to the user. Users look for the padlock symbol on the login form, and yours doesn't have one.

Answer 2

Yes, it is a security flaw.

Since the form is served over HTTP, it is subject to being edited along the way. This edit could be, for example, the additional of JavaScript that sends the credentials to a server that the attacker controls as well as letting the browser log in normally.