logins with no SSL?

D

Doug

I noticed that there are many prominant sites out there that do not use
SSL for logins. 2 are www.blackplanet.com and www.blackboard.com

Although blackboard has something like this:

function validate_form(form) {

var passwd_enc = calcMD5(form.password.value);
var final_to_encode = passwd_enc + form.one_time_token.value
form.encoded_pw.value = calcMD5(final_to_encode);
form.password.value = "";

return true;

I'm not really sure what this means... My guess is that the website
hashes the password on the server and checks to see if it matches the
one hashed on the client side.

But my question is, is SSL needed? I am planning to do a site, and now,
I'm not even sure if I should use SSL because it takes some effort to
set it up, and some sites don't use it. Also, a related question: will
implementing logins via SSL slow down the server?

-d
 
T

Toby A Inkster

Doug said:
I'm not really sure what this means... My guess is that the website
hashes the password on the server and checks to see if it matches the
one hashed on the client side.
Click to expand...

Yes, but this means that your login requires Javascript so you lose all
visitors who don't have Javascript available/enabled.

Imagine powering down your web server as the clock strikes 12 on New
Year's Eve/Day and then not turning it back on until 11am on the 17th of
February. According to recent statistics that's how many visitors you'll
lose by relying on Javascript: 13%.
 
D

David Dorward

Doug said:
I noticed that there are many prominant sites out there that do not use
SSL for logins.
Click to expand...
My guess is that the website hashes the password on the server and checks
to see if it matches the one hashed on the client side.
Click to expand...

Which is pretty useless. The combination of characters sent to the server is
can still be copied.
But my question is, is SSL needed?
Click to expand...

What are the consequences of your security being broken? If they are
significant then SSL is needed.
Also, a related question: will implementing logins via SSL slow down the
server?
Click to expand...

Yes... but probably not significantly.
 
C

Charles Sweeney

Doug said:
I noticed that there are many prominant sites out there that do not use
SSL for logins.
Click to expand...

Yep, and just about EVERY site sends you passwords in plain email.

Spose it depends what you're doing, protecting the crown jewels or running
a forum?

I like many don't use SSL for logins, butI'm not looking after the crown
jewels.

As ever though, don't put anything precious on the web.
 
C

Charles Sweeney

Toby said:
Imagine powering down your web server as the clock strikes 12 on New
Year's Eve/Day and then not turning it back on until 11am on the 17th of
February. According to recent statistics that's how many visitors you'll
lose by relying on Javascript: 13%.
Click to expand...

At least you would get peace for a while.
 
W

Wayne

Toby said:
Doug wrote:




Yes, but this means that your login requires Javascript so you lose all
visitors who don't have Javascript available/enabled.

Imagine powering down your web server as the clock strikes 12 on New
Year's Eve/Day and then not turning it back on until 11am on the 17th of
February. According to recent statistics that's how many visitors you'll
lose by relying on Javascript: 13%.
Click to expand...

How did you arrive at the 13% value? A recent post listed

http://www.w3schools.com/browsers/browsers_stats.asp

as a resource for browser statistics and that site lists 92% in January
2004 as the number of browsers with javascript enabled. According to
the posted statistics, the number with javascript disabled has been
dropping steadily from 12% in October 2002 to 8% in January 2004.

Wayne
 
B

Bill Logan

Charles Sweeney said:
Yep, and just about EVERY site sends you passwords in plain email.

Spose it depends what you're doing, protecting the crown jewels or running
a forum?

I like many don't use SSL for logins, butI'm not looking after the crown
jewels.
Click to expand...
Heh, I 'always' look after the crown jewels - but then I dont know how to put
them on the web:)
 
T

tlshell

According to
the posted statistics, the number with javascript disabled has been
dropping steadily from 12% in October 2002 to 8% in January 2004.
Click to expand...

I find javascript unreliable as very often my browser will not accept
it. It must be some quirk of my security settings as people swear up
and down that NS7.02 works on their javascripts with no problems.
JS Submit buttons are particularly a pain, probably because of all the
checking that is done via JS.

There are two sites I use that don't work, one is
"http://www.mysurvey.com/" where everything is fine except at the very
end when they are updating my stats. Fortunately, I've discovered that
it doesn't affect my interactions with them so I just blow that part
off and go merrily on my way. (They give points for answering surveys
which add up to money or prizes so it's worth the trouble.) The other
is "http://www.asianfoods.com/" where I have to manually enter
"https://www.asianfoodgrocer.com/index.asp?PageAction=CARTCHECKOUT" in
order to complete my order instead of hitting the "checkout" button.
Very odd, I'd say, but manageable.

It's the ones that *aren't* manageable that get me pissed off, and
then I may write insulting (or not) letters to the webmaster or other
company whipping post.
 
T

TechnoHippie

Bill Logan said:
Heh, I 'always' look after the crown jewels - but then I dont know how
to put them on the web:)
Click to expand...

Please, please don't tease :)

You could always x-face them.
 
M

Mark Parnell

then I may write insulting (or not) letters to the webmaster or other
company whipping post.
Click to expand...

Whereas most people would just leave and never come back, so the company
will never even know that they are losing customers.
 
D

Doug

David said:
Doug wrote:




Which is pretty useless. The combination of characters sent to the server is
can still be copied.
Click to expand...

I thought it was pretty useful. The server sends a random number to the
client that both the client and server add to end of the password. So,
it never uses the same hash twice.

-d
 
D

Doug

Toby said:
Imagine powering down your web server as the clock strikes 12 on New
Year's Eve/Day and then not turning it back on until 11am on the 17th of
February. According to recent statistics that's how many visitors you'll
lose by relying on Javascript: 13%.
Click to expand...

Perhaps I could do it two different ways... One for people who do not
have JavaScript, one for those who do. I'll look into that.

-d
 
N

Neal

Perhaps I could do it two different ways... One for people who do not
have JavaScript, one for those who do. I'll look into that.

-d
Click to expand...

If you have a way that works for non-Js people, why not use just it?
Instead of twice the code and twice the work?
 
D

Doug

Neal said:
If you have a way that works for non-Js people, why not use just it?
Instead of twice the code and twice the work?
Click to expand...

Well, it wouldn't really be twice the code... May be some extra
JavaScript code, but basically, the JavaScript would hash the password.
If JavaScript is not available, it would just do it the regular way.
I can cut and paste the JavaScript code to hash the password.

a hidden var in the form could be JavaScriptAvailable=true

it would be no big deal.

-d
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Asynchronous Logins 8
Secure ssl connection with wrap_socket 3
Trying to get SSL with client cert to work within POE environment 2
Only one table shows up with the information 2
configuring SSL on AD 0
Beginner's Guide to getting CipherSweet working with PDO and MYSQL 1
What timeouts are required when reading SSL certificates with Python2.6.4? 1
How to effectively develop a web application from scratch? 0

Members online

No members online now.
Total: 28 (members: 0, guests: 28)
Robots: 203

Forum statistics

Threads
473,766
Messages
2,569,569
Members
45,042
Latest member
icassiem

Latest Threads

Top