Login Forms Over HTTPS, Please
> <i>If you’re submitting your login form over HTTPS, that’s good, but it’s not enough. You have to </i>deliver* the form over HTTPS too.*<p>I'm glad they mentioned it. Too many people think their sites are secure if logged in sessions use https and everything else is http.<p>Their example is that an attacker could insert JavaScript to steal the password, however they could just as well change the form target from https to http which is even less noticeable.<p>There's also a more detailed post [0] with reasons and explanations. You can enable this setting in Firefox 44+ by setting `security.insecure_password.ui.enabled` to true.<p>0: <a href="https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-over-http-please/" rel="nofollow">https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-...</a>