|
|
Posted by Sanders Kaufman on 12/19/06 19:11
Vincent Delporte wrote:
> On Tue, 19 Dec 2006 09:01:31 GMT, Sanders Kaufman <bucky@kaufman.net>
> wrote:
>> No matter how tight your security is, if users login over HTTP,
>> their credentials can be tooooo easily intercepted - making all
>> other security measures worthless.
>
> So HTTPS should be used when logging on and receiving the session ID
> cookie, but from then, it's OK to use HTTP?
That depends on what is happening from then.
ANY time sensitive data crosses the web, it should be over HTTPS
to prevent others from sniffing it out.
But HTTPS takes up more resources than regular HTTP. So where
sensitive data is not being shuffled about, HTTP is the better
choice.
Navigation:
[Reply to this message]
|