I'm creating a web API in .Net for a web application. I'm wondering what the industry standard for login authentication is.
I know that most people believe that sending cleartext username/passwords over SSL is enough security, but I don't want to place all of my trust that SSL won't be broken in the future and I'm a firm believer in security in layers.
How else can I add more layers of security to my login authentication besides SSL and cleartext usernames/passwords? Client side encryption? Challenge-response?