Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I note that the xp-dev.com website (delegated SVN space) offers a regular HTTP login page but this page then has link to a "secure login" which is a login page but under SSL.

I wonder what the point of defaulting to HTTP was when surely an SSL login page would be better anyway?

Is it a browser compatibility issue? Do any other websites do this?

share|improve this question
2  
Random guess...the information on the site isn't anything overly secure or sensitive, and people using the site are only using it for something like personalizing their login experience, not saving financial information or personal information. Breaking into Bob's account would what...change a color scheme? As long as they didn't use the same password they use for their bank account, it wouldn't do much harm. But that's just a guess. –  Bart Silverstrim Jul 2 '10 at 12:08
    
Adding to Bart's comment. It probably still uses HTTP Digest authentication, where the password is MD5 hashed and incredibly hard to break. Only the username is sent in clear text; and usernames are probably freely available through the SVN anyway. If this is all the case, the website has done a good job of apply security where it's needed (and allowed extra security for those who enjoy security theater). –  Chris S Jul 2 '10 at 12:40
add comment

2 Answers

up vote 2 down vote accepted

SSL is a big hit for sever performance compared with http, so I would guess that the webmaster is worried about scalability. The visitors who are concerned about high security can make the extra click to use the SSL login.

share|improve this answer
    
Aha~, I would guess that scalability is pretty high on their concerns list. Interesting info, thanks. –  Dougal Jul 2 '10 at 16:34
add comment

Some broswer or script will not accept SSL, so unless SSL is really mandatory (it's mandatory when you will submit/access sensitive data CreditCard number, .. ) it's generally a good idea to keep an HTTP login page for people that can't use SSL.

In your case it's more likely that information on this site when your are logged is not very confidential (I mean it's not you bank account) so they choose to offer a default HTTP login page, this use less CPU on server (SSL use a lot of CPU) but they still allow HTTPS login for user wanting more security. (or think that their network can be sniffed)

share|improve this answer
    
What browsers don't accept SSL? –  Webnet Jul 2 '10 at 13:14
    
Take a unix and build a webbroswer and don't link to openssl/gnutls and you get a broswer that don't support SSL. Take a quite old computer and you get a broswer supporting SSL but the SSL stack me be to old to work with some website... I agree that it's not commun but this exist –  radius Jul 2 '10 at 13:53
    
"it's generally a good idea to keep an HTTP login page for people that can't use SSL." but could you give me any examples of websites doing this? Why I ask the original Q is because I've never seen it anywhere else, only xp-dev.com –  Dougal Jul 2 '10 at 16:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.