スラッシュドット・ジャパン

1. Break in the chain of trust:
Some websites forward users to new pages that have different domains without notifying the user from a secure page. In this situation, the user has no way of knowing whether the new page is trustworthy.

2. Presenting secure login options on insecure pages:
Some sites present login forms that forward to a secure page but do not come from a secure page. This is problematic because an attacker could modify the insecure page to submit login credentials to an insecure destination.

3. Contact information/security advice on insecure pages:
Some sites host their security recommendations, contact information, and various other sensitive information about their site and company on insecure pages. This is dangerous because an attacker could forge the insecure page and present different recommendations and contact information.

4. Inadequate policies for user ids and passwords:
It is important to maintain consistent and strong policies on passwords and user ids. We found some sites allow customers to use short passwords or they require e-mail addresses for user names.

5. E-Mailing security sensitive information insecurely:
E-mailing any sensitive information is dangerous. We found that some sites offered to send statements and passwords through email but not very many people have secure e-mail.