I agree, but I can see why most places do not do this.
1) SSL on the server side eats up a lot of cpu time. Yes, this day and
age there are proxy boxes,ssl off-load boxes, faster cpu's..ect,
But not everybody has the money or time to upgrade. When you get
thousands or millions of hits, it can make a difference.
2) Most login functions are more then just a form based login. It may
look like your about to enter your info in cleartext, but a correct
Page will encrypt the info and pass you to a ssl page.
There are a lot of other items besides ssl that can hurt you. One quick
example - cookies. A poor program could store info in the clear in a
cookie and even leave it on your hard disk.
Jeff
-----Original Message-----
From: Dave Ockwell-Jenner [mailto:doj@solar-nexus.com]
Sent: Wednesday, June 22, 2005 07:05 AM
Cc: webappsec@securityfocus.com
Subject: Re: Should login pages be protected by SSL?
From a purely non-technical viewpoint: it may be a good idea for the
login page to be protected by SSL if for no other reason that having the
browser show the "padlock" symbol. It's something that non-technical,
non-web developer people can see and (somewhat) understand. Since they
are typing their password on a page, that's what many associate with -
"I'm not entering my password here, I don't see the padlock".
Amir Herzberg wrote:
There may be some argument even in this case (privacy, tendency of
users to use same passwords, ...). But this was _not_ my intent. I may
not have been clear, but I am interested in sensitive sites -
financial, shopping, security (CA, DNS, SSO, Portals, etc.). As you
can see in my `Hall of Shame` http://AmirHerzberg.com/shame.html, many
of these don't use SSL to authenticate the login page, only to encrypt
the password (when using a correct login page).
So, the real question I'm asking: should login pages to sensitive
(e.g. financial) sites be protected by SSL?
--
Dave Ockwell-Jenner
Solar Nexus Solutions
http://www.solar-nexus.com/
-----------------------------------------
This e-mail message is private and may contain confidential or privileged
information.
