RE: Should login pages be protected by SSL?

[Glenn Euloth <eulothg () hfx eastlink ca>]

"something" is just not enough to require TLS or SSL, etc.  While I believe
that security is extremely important I also recognize that there is a
trade-off which we all may or may not agree with between security,
usability, and simple business practices.

When you park your bicycle at the corner store, you don't put it in a vault
with armed guards and killer dogs to protect it.  Consequently, you wouldn't
leave millions of dollars in diamonds and gold sitting unguarded in your
backyard.  It is important to weigh the cost of what you are protecting
against the cost of protecting it.

Usability is also a factor.  If you configure your system in such a way so
that only security-minded computer professionals can actually access it then
you might as well not put the information on the Internet in the first place
as it's not usable.  Unless of course, "security-minded computer
professionals" is your target audience.  You can't, however, expect your
grandmother to properly configure her browser to be highly secure just to
log in to a web-based forum where she can post her favourite blueberry pie
recipe.  If someone breaks into her account does it really matter?  And why
would someone bother in the first place?  Where's the value in breaking in
to such an account?

Blanket statements such as "you must always use TLS/SSL on a web-based login
form" are not the way to go.  We owe it to public to warn people when they
are using a $1.99 padlock to protect their life savings but telling them
they need an armed guard to go to the store to buy milk is fruitless.

Regards, Glenn Euloth

-----Original Message-----
From: Andy bentley [mailto:andy () bentleyconsulting biz] 
Sent: June 20, 2005 9:43 PM
To: webappsec () securityfocus com
Cc: webappsec () securityfocus com
Subject: Re: Should login pages be protected by SSL?

Amir Herzberg wrote:

> Here is a simple question: should web login forms be always protected 
> by SSL?
IMO, If you have a logon page on a site, there is almost by definition
"something" of value that needs protection. The value of that asset
determines the expense of protecting it. If the value is over that price 
of a server side cert, then its a no brainier.   Yes Logins should be 
protected by TLS.    SSL 2.0 is weak, and was replaced by SSL 3.0.  SSL 
3.0 was replaced by TLS in 1999.   You should NOT be using SSL.   
Unfortunately, Microsoft ships all of their OS/Browsers with SSL 3.0 
turned ON and TLS turned OFF.   That is a bug that they need to fix.   
So if your customer base uses M$ & I.E. and is too ummm.. backward to switch
their security settings, you still must enable SSL 3.0 on your 
server to allow those users to access your server.    But you should 
disable SSL 1, SSL 2 on your server to disallow folks try to negotiate down
(Oakley) to the lowest common denominator SSL.

Andy Bentley CISSP