Re: Should login pages be protected by SSL?

[Amir Herzberg <herzbea () macs biu ac il>]

Steve Shah wrote:
> On Tue, Jun 21, 2005 at 12:07:34PM +0200, Amir Herzberg wrote:
>
> > experts really agree here, but since some of the companies object, I am 
> > interested to see if there are some serious defenses of the unprotected 
> > login practice.
>
>
> Even with my security hat on, I'd be pressed to justify the load of an
> encrypted login for a content site that just needs to identify me to
> extract some marketing data from their logs. 

There may be some argument even in this case (privacy, tendency of users 
to use same passwords, ...). But this was _not_ my intent. I may not 
have been clear, but I am interested in sensitive sites - financial, 
shopping, security (CA, DNS, SSO, Portals, etc.). As you can see in my 
`Hall of Shame` http://AmirHerzberg.com/shame.html, many of these don't 
use SSL to authenticate the login page, only to encrypt the password 
(when using a correct login page).

So, the real question I'm asking: should login pages to sensitive (e.g. 
financial) sites be protected by SSL?

--
Best regards,

Amir Herzberg

Associate Professor
Department of Computer Science
Bar Ilan University
http://AmirHerzberg.com

New: see my Hall Of Shame of Unprotected Login pages: 
http://AmirHerzberg.com/shame.html