I am currently working on my SSL/TLS assignment and I got a question to ask. What is the use of a login password since it is not needed for establishing secret communication between your computer and a secure server?

  • 1
    If a cop pulls you over on an empty road, you and the cop are having a private conversation. Why does he need to ask you for an ID? – John Wu Nov 12 '13 at 6:32

SSL/TLS provides confidentiality and integrity, but does not provide authentication for the client ( well technically it can using mutual SSL authentication, but this has its limitations as you would need to disperse your client certificate across all your devices). A password is easier to use as the user can remember it more easily.

| improve this answer | |

The common SSL/TLS implementation found on the Internet is not used to authenticate users into web applications, but to provide different perks.

By encrypting the data channel between the client and the server, SSL/TLS is able to preserve the confidentiality and integrity of the transmitted information, preventing attackers from sniffing the coomunications.

Furthermore, SSL/TLS provide a way to confirm the identity of the web server that the user is trying to reach.

This implementation does not cover the authentication to the web application the user wants to browse. Hence, credentials are needed and SSL/TLS do not replace this need.

As a side note, remember that SSL/TLS could also be used to provide mutual authentication between the server and the client. Even if this solution is rarely employed, it could replace authentication credentials.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.