Member Avatar for webdango

Most of us have seen FaceBook and Twitter have a login form on their homepage; facebook also have the registration form.

As far as I know the way to secure any kind of sensitive data is through the use of a SSL. Apparently FB and TW dont have any on their home page.

I found some options of using jquery, javascript etc. But I dont find it much useful since JS can be disabled by some users.

My question is, is it possible to secure data transmission without using SSL?

Edited by webdango because: n/a
  • 2 Contributors
  • 3 Replies
  • 95 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by sheltant

Dani AI

Generated

A practical, secure login for a public website should use TLS/HTTPS rather than trying to invent a custom transport. Alternatives exist (network-level tunnels, client-side-only crypto, older protocols) but they are either impractical for a public audience or fragile in the face of a man-in-the-middle that can modify the page before the browser runs any client code. raised the right concern about client-side approaches; they break when JavaScript is disabled or the page has been tampered with. ’s point about protecting all traffic is correct for private networks, but that model does not scale to an open website.

Concrete checklist to secure a login flow now:

  1. Obtain and install a valid TLS certificate (automation is widely available).
  2. Serve the login page and the login POST endpoint over HTTPS only. Never accept credentials over plain HTTP.
  3. After authentication, issue session cookies with the Secure, HttpOnly, and SameSite attributes and rotate session IDs at login.
  4. Enable HSTS so browsers refuse plain-HTTP access for the site once a user has seen HTTPS.
  5. Use modern TLS configuration (TLS 1.2+), strong ciphers, and test with a tool like SSL Labs.
  6. Protect the server side: slow salted password hashing (bcrypt/Argon2), CSRF tokens, and optional two-factor authentication.

Short-term partial HTTPS (only the form action) reduces bandwidth but leaves you open to form-tampering attacks. For real security and simpler operations, aim for site-wide HTTPS. For deployment and hardening guidance, see OWASP’s transport-layer guidance and browser HSTS docs, and consider free automated certificates from LetsEncrypt.

Transport Layer Protection Cheat Sheet
Strict-Transport-Security (MDN)
Let’s Encrypt

Recommended Answers

All 3 Replies

Member Avatar for sheltant

is it possible to secure data transmission without using SSL?

Yes...It is Possible

If have a IPSec/L2TP Tunnel established...!! with your HTTP Server...

But this need a IPSec Client to be installed in your PC (Say : CISCO VPN Client).

If a IPSec Tunnel is established with a Server then all the Data to the server will be Encrypted , Authenticated and Secured..

Where as in case of HTTPS/SSL , only that particular SSL-Session will be Secured..

Regards,

Sheltan T T

Member Avatar for webdango

Hi sheltant, thanks for the reply. I dont want all the data transferred to and from the server encrypted. that will put huge load on the server.

Is it possible to have only certain parts of some selected pages transfer securely without using https??

I heard of S-HTPP (secure http). But I cant find any information online how to implement that. Any suggestions??

Edited by webdango because: n/a
Member Avatar for sheltant

For more detailed implementation of S-HTTP Kindly follow the link below,,

http://www.homeport.org/~adam/shttp.html

For S-HTTP Server implementation in MAX-OS follow the link below

However , I don't find any of our Internet Browsers( say IE, Netscape, FireFox) supporting S-HTTP..Because of the evolution of HTTPS...

Hope you got the answers ,

Regards,

Sheltan T T

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.