I am currently working on my SSL/TLS assignment and I got a question to ask. What is the use of a login password since it is not needed for establishing secret communication between your computer and a secure server?
closed as unclear what you're asking by Adi, NULLZ, Ayrx, Scott Pack, Xander Nov 11 '13 at 15:57
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
SSL/TLS provides confidentiality and integrity, but does not provide authentication for the client ( well technically it can using mutual SSL authentication, but this has its limitations as you would need to disperse your client certificate across all your devices). A password is easier to use as the user can remember it more easily.
The common SSL/TLS implementation found on the Internet is not used to authenticate users into web applications, but to provide different perks.
By encrypting the data channel between the client and the server, SSL/TLS is able to preserve the confidentiality and integrity of the transmitted information, preventing attackers from sniffing the coomunications.
Furthermore, SSL/TLS provide a way to confirm the identity of the web server that the user is trying to reach.
This implementation does not cover the authentication to the web application the user wants to browse. Hence, credentials are needed and SSL/TLS do not replace this need.
As a side note, remember that SSL/TLS could also be used to provide mutual authentication between the server and the client. Even if this solution is rarely employed, it could replace authentication credentials.