Re: Should login pages be protected by SSL?

[Dave Ockwell-Jenner <doj () solar-nexus com>]

From a purely non-technical viewpoint: it may be a good idea for the 
login page to be protected by SSL if for no other reason that having the 
browser show the "padlock" symbol. It's something that non-technical, 
non-web developer people can see and (somewhat) understand. Since they 
are typing their password on a page, that's what many associate with - 
"I'm not entering my password here, I don't see the padlock".

Amir Herzberg wrote:

> There may be some argument even in this case (privacy, tendency of 
> users to use same passwords, ...). But this was _not_ my intent. I may 
> not have been clear, but I am interested in sensitive sites - 
> financial, shopping, security (CA, DNS, SSO, Portals, etc.). As you 
> can see in my `Hall of Shame` http://AmirHerzberg.com/shame.html, many 
> of these don't use SSL to authenticate the login page, only to encrypt 
> the password (when using a correct login page).
>
> So, the real question I'm asking: should login pages to sensitive 
> (e.g. financial) sites be protected by SSL?


--
Dave Ockwell-Jenner
Solar Nexus Solutions
http://www.solar-nexus.com/