I am semi-embarrassed to ask this question having worked in the field for 20 years, but can someone describe to me why I should run SSL on any web site that uses authentication? I understand the bigger "why" issues (people use same password on blog and bank) and I am assuming that the passwords are stored encrypted on the site database, but I want to really, simply, explain the technical risk of transmitting non-SSL passwords in a way that is grounded in practical application.
Example: I have a wordpress blog I am hosting on bluehost. I go to the login page and enter my username and password and press submit. That information is sent to the web server in an unencrypted HTTP POST.
Now if someone is on my network or any network where the packets are broadcast, running a sniffer, they can get read the packets and write code to parse for interesting words like "login" or "password." Is that how it works?
How would this work in my example? Assume there is nobody on my home network--that otherwise, I have taken appropriate security measures for devices that are within my control. How does the hacker get in between me and my website? Would he or she just log on to their own bluehost account and be able to monitor all traffic on the subnet? Or could they be ANYWHERE in between; e.g. I'm on Verizon FIOS, so maybe they get onto (install an automated process) a server somewhere within the Verizon network. Or could they literally be anywhere?
My understanding of networking is that my device broadcasts packets with a destination IP that is the bluehost server. Those packets get "noticed" and resent by my router to upstream routers and switches that are part of the Verizon network. As they cross each subnet, the potential exists for any device sitting on that network to observe the packet as it is broadcast locally. Good practices would have those networks set up with security that did not result in people being able to get in the middle...but once the information gets to bluehost, then we are at their mercy in terms of broadcast packets. Once the http server "hears" the POSTed information, it encrypts and compares against the locally-encrypted password.
Is this an accurate way to think about it and explain to others?