4

Possible Duplicate:
What are the pros and cons of site wide SSL (https)?

I'm creating a custom PHP/MySQL CMS for a client (because Wordpress is overkill for this client's particular needs). Now, I know this client uses a public wi-fi location quite a bit, so here's the question.

Say the CMS is located at http://customcms123.com and the login page is located at http://customcms123.com/admin

Does it make sense to encrypt just the login page, i.e. ? So once the user authenticates and goes to another page, say contact, it would look like http://customcms123.com/admin/contact.php (not httpS in this case).

Is it possible for a packet sniffer (or any other tool) to detect the login credentials once the user has logged in? To rephrase the question, is it sufficient to secure just the login page?

I'm not a network guy, so I'm not sure what data gets transmitted over a public wi-fi as seen from a sniffing tool and what not.

Improve this question
5
  • For those interested in this topic, I found another great answer on StackOverflow: stackoverflow.com/questions/1211638/…
    – JohnJ
    Commented Aug 30, 2012 at 19:30
  • 2
    Consider Firesheep was made to prove this was a bad idea as a WiFi sniffer can reqeust a session cookie based on your unencrpted details post secure login and sidejack the session.
    – zedman9991
    Commented Aug 30, 2012 at 20:26
  • Your ref is three years old and Firesheep is two years old.
    – zedman9991
    Commented Aug 30, 2012 at 20:29
  • John, welcome to Information Security. As you can see, this issue was already discussed and answered, some while back. It's always a good idea to search the site first, to see if your question was already asked... :-)
    – AviD ♦
    Commented Aug 30, 2012 at 20:44
  • Thanks AviD. I've actually been pretty active on SO (different login), so I'm quite familiar with using the site. I guess I slipped when it came to this one. Sorry about that, but got some good answers out of it. :)
    – JohnJ
    Commented Aug 30, 2012 at 21:43

2 Answers 2

Reset to default
6

That's really a question based on the needs of your site and it's users. SSL provides two main services. For one, it validates the identity of the server that the user is connecting to for the user. It also protects the transmission of sensitive information from the user to the server.

If the majority of your site is not sensitive if spoofed and does not require the user to transmit sensitive information, then there is no reason it is necessary to use SSL on the rest of your site. It is worth noting that if the user is accessing the site via a non-SSL protected page, it is possible for someone to jump in between the user and the website and hijack the session, so the identity of a logged in user should generally not be trusted outside of an SSL connection, but this is also not always a problem, depending on your security needs.

As for your question about when credentials are transmitted, as long as your site is configured correctly, once a session is associated with a user, the credentials should not need to be retransmitted in the clear. The exact details of how the session is maintained would depend on what approach is being used, but most generate some kind of token or unique identifier upon authentication and transmit that instead. The identifier then becomes invalid when the session expires.

Improve this answer
2

Building on AJ's answer above - if you are not encrypting the connection, any data sent back and forth is exposed. Do you have sensitive information such as logins, user names, hashes, personally identifiable information (PII), or other information in cookies or being sent through POST or GET, what about things going on through AJAX?

If your site is not going to experience a huge performance hit and isn't segregated in such a way that you need to obtain additional SSL certs, you might as well use SSL.

I would also recommend encrypting a contact form. I know plenty of businesses who have customers who think a contact form is great place to send them credit card numbers, account numbers, and all sorts of other PII or sensitive pieces of data. There is more to protect then just credentials; ultimately, you want credentials so you can access other valueable information.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .