WebApp Sec: Re: Should login pages be protected by SSL?

[Amir Herzberg <herzbea () macs biu ac il>]

maburns () safenet-inc com wrote:
> The login page cannot be protected by SSL until after the authentication is
> complete. Once the user is authenticated then all information sent between
> the server and remote user is in a ssl encrypted tunnel until the session is
> ended. 
This may be a bit misleading to readers not sufficiently familiar with 
SSL, so let me clarify. The SSL tunnel is established using the server's 
certificate (and optionally- and rarely used - using client's 
certificate). All traffic, including user authentication if using cookie 
or password, is inside the tunnel.
--
Best regards,

Amir Herzberg

Associate Professor
Department of Computer Science
Bar Ilan University
http://AmirHerzberg.com

New: see my Hall Of Shame of Unprotected Login pages: 
http://AmirHerzberg.com/shame.html