In principle yes, butyou may be able to defend against passive attacks. But in practice, it's non-trivial and not really: it'll be a kludgegreat solution.
|2||added 58 characters in body|
In principle yes, but in practice, not really: it'll be a kludge.
Now I'm not saying it's impossible. It almost certainly isn't. It is almost certainly possible to build a web site and a solution that prevents most passive attacks. But it will be complex and non-trivial. That means you'll need considerable security expertise to build it, and there's still a non-trivial chance you screw something up. It also means that the result will be expensive. And the security is inherently limited -- any scheme will be only a partial solution/mitigation -- so the value is limited. I don't think it's a good tradeoff.
If you want to read about state-of-the-art attempts to defend against eavesdropping without use of SSL, here's a great resource for you:
I'd also like to share with you some resources on making SSL perform well:
SSL isn't free -- but also keep in mind that people sometimes assume the performance impact of SSL will be worse than it actually is.