Administrator
ID Verified
Trusted
Geekzone
Some fact checking please...
I contact Telecom New Zealand about this and got this reply:
The Telecom wireless hotspot log-in page is itself not secure, but as soon as someone enters details and presses submit it is sent over a secure connection using SSL.
The SSL connection is really the primary precaution we take to protect the customer from things such as phishing scams.
SSL certificates are required to establish an SSL connection. These certificates are issued by Certificate Authorities or CAs, The CA, such as the well know VeriSign authority we use, take a lot of precautions to insure they only issue certificates to reputable organisations. So basically if the web site the user name and password are being submitted to (over a secure connection) has a valid certificate the user can be assured that the web site is the domain it claims to be and not some sort of phishing scam site.
Telecom follows the same format for its wireless hotspots as other international providers and is unaware of any such security issues to date.
I thought it was strange, so I walked to the usual Johnsonville Mall with baby and tried logging into the TNZ Hotspot service here. Although the login page itself is not encrypted, the POST page is:
[FORM name="WifiLoginForm" method="POST" action="https://auth.telecom.co.nz/live/wifi/wifilogin/WiFiLogin" onsubmit="return validate()"]
So, I think this settles the question of your login credentials being secure or not when you submit the data from a valid page. It is secure.
Still there's the problem of someone setting up a rogue Telecom New Zealand Hotspot just to collect credentials. This should be easily prevented if an encrypted page options was available.
