Secure iframe in unsecure document?

Question

Hello.

I'm building a website for a sports center. Registrations are handled through a third-party software program. There are options to register directly through the third party's site or to integrate the registration form into my site with iframes.

Since I'd rather not send people to another site, I went with the iframes option. My question is, can I be sure that people will be getting the same level of security in the iframe as they would on the completely-secure third-party page?

Thank you.

Answer 1

This design does make you more prone to SSLStrip. I recommended watching the video of Moxie Marlenspike's Talk. Although in practice such an attack isn't common.

This iframe would not be a violation of OWASP A9: Insufficient Transport Layer Protection. However if you are planning on letting people login to the HTTP site, or if you are transmitting a session id over HTTP then this would be clear violation of OWASP A9.

In short, https is absolutely necessary to protect your users.