Re: [summary] Re: Should login pages be protected by SSL?

[Ole Kasper Olsen <olekasper () gmail com>]

On Wed, 22 Jun 2005 14:35:01 +0200, Steve Shah <sshah () risingedge org> wrote:

> Amir Herzberg asked the question of "should login pages be SSL
> encrypted". The flurry of discussion can be summerized as "Yes"
> with the following details:
...
> 2. Most people believe that a login page *should* be encrypted
>    for web sites carrying important data. (e.g., financial, etc.)

Encryption is not the point. Authentication is. A login page will
never contain sensitive data anyway and as long as the form is
submitted to a secure server, the data is encrypted just fine. A
problem arises when a customer is tricked into entering credentials at
an a bogus site.

SSL/TLS has decent capability for providing authentication, however
the sad truth is (as Michael Silk noted) that a vast majority of
surfers do not understand nor read certificates. People don't even
look at the URL (many (probably very successful) scams just rely on a
semi-decent-looking link which points to an IP address).

-- 
mvh / Best Regards,
Ole Kasper Olsen
MSc Student -- NISlab / Gjøvik University College