Re: Should login pages be protected by SSL?

[Andy bentley <andy () bentleyconsulting biz>]

Amir Herzberg wrote:

> Here is a simple question: should web login forms be always protected 
> by SSL?
IMO, If you have a logon page on a site, there is almost by definition 
"something" of value that needs protection. The value of that asset 
determines the expense of protecting it. If the value is over that price 
of a server side cert, then its a no brainier.   Yes Logins should be 
protected by TLS.    SSL 2.0 is weak, and was replaced by SSL 3.0.  SSL 
3.0 was replaced by TLS in 1999.   You should NOT be using SSL.   
Unfortunately, Microsoft ships all of their OS/Browsers with SSL 3.0 
turned ON and TLS turned OFF.   That is a bug that they need to fix.   
So if your customer base uses M$ & I.E. and is too ummm.. backward to 
switch their security settings, you still must enable SSL 3.0 on your 
server to allow those users to access your server.    But you should 
disable SSL 1, SSL 2 on your server to disallow folks try to negotiate 
down (Oakley) to the lowest common denominator SSL.

Andy Bentley CISSP