So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an e-mail/username with a password).
Specifically, I've been checking to see whether they implement any kind of protection with regards to these tokens, and I've been finding a disturbing number of sites simply send these tokens as plaintext POST data.
Many sites do encrypt, despite the fact that they don't handle confidential information. Other, content-equivalent sites, don't bother.
I've mentioned this to the administrators of the sites I found. One changed policy. Some didn't respond. Once used the argument that a lot of other sites don't do it, so he shouldn't bother, and it might be prohibitively expensive.
Obviously, the 'bystander effect' argument is an awful one. But since I don't have the numbers, and would default to using SSL myself, is implementing this basic security feature really all that expensive?
Or, more specifically, his argument was that his site wasn't large enough to make the financial investment worth it. Is this an argument that makes sense?
-- And, not strictly important, but I'm curious --
Has any research been done on how many people are careful about password use? Has anyone ever put a sniffer near a public wifi and checked to see whether this could be a problem in practice for John Q. Public?
EDIT: Also, relating to that last, not-strictly-necessary, question... In order to do a conclusive study on this subject and draw realistic conclusions, it seems like someone would have to break a number of laws, even if they were very careful in the way they handled the data, and used it for nothing apart from the study. Are there currently avenues in place by which this type of research can be done in a legal, controlled, responsible manner?