In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form.
The response to my warning was that "We protect against man in the middle attacks. So still doesn't apply."
Is it possible to "protect" against a MITM attack without implementing SSL (I'm aware SSL isn't bulletproof either, but always thought it was the first step)?