RE: Should login pages be protected by SSL?

["Almerindo Graziano" <agrazian () unina it>]

Amir,

I am strong advocate of having SSL-enabled login forms. The reason for that
being that SSL is meant to "prove" the authenticity of the website I am
giving my credentials to. Nevermind that the non-SSL login form actually
submits my credentials securely using SSL. What if the site with the
unprotected form is a spoofed one? How do I know it won't take my
credentials and just return me an error page or something?

I just have to take my chances and hope it will send my credentials to the
intended trusted server using SSL; or do I have to inspect the source code
of the page to work that out? But I don't want to examine the source code of
every non-SSL login page...

For this reason I also believe that such practice, especially from notable
banking and commercial organizations (your list on the hall of shame),
encourages common users (people who are not subscribed to this list :-) to
believe that giving their credentials to a non SSL-enabled login page is
actually secure. No doubt it can be "secure enough" in some cases and we can
present all the risk assessment cases that we want. The issue here is about
user education, and user should be educated not to give out their
credentials to strangers, which is exactly what happens when they use a
non-SSL login form.

I hope this provides you with a strong argument for having login pages
protected by SSL

Ciao

Al