Is a secure domain (HTTPS) totally necessary for a sign in page?

Question

It seems that most major websites will use a secure domain, but there are a few major exceptions, notably facebook and twitter.

The benefits of using a secure domain are obvious I suppose - your login credentials are never transmitted in plain text.

So how do major sites like facebook and twitter get away with it? If a secure domain is not available for some reason, what extra precautions might one take?

Answer 1

If security is at all important: Yes, the sign in page must be https, as must the page that it posts to. There simply is no other way.

If you visit a page, and it isn't https, you absolutely can not trust anything submitted from that page. Since the connect is not protecteded, it can be easily tampered with (perhaps by making it submit to a non-https page, or perhaps submitting to an altogether different domain, which you will never know until it is too late). Whereas if you visit an https page, you can trust it. You know where the page originated from and that it hasn't been tampered with. And of course you must submit to an https page, since you want that data to be encrypted (and the browser should warn you if it tries to submit a form from an https page to a non-https page).

Answer 2

Sorry for the late post but I don't think anyone above addressed the key element to how facebook and twitter do it. The main part is, their non-HTTPS login form posts to an absolute URL over HTTPS.

Look at the action:

// facebook
<form method="POST" action="https://login.facebook.com/login.php?login_attempt=1" id="login_form">

// twitter
<form method="post" id="signin" action="https://twitter.com/sessions">

In this case, a form's "action" is set to use https and the ssl handshake takes place before any data is sent so the connection is secure. (Whether or not the original form is displayed using https doesn't matter). However, if the form action used a relative path, then it would default to the protocol that was used to display the form. Bottom line, you must use an absolute URL if you want to establish an SSL session before your credentials are sent.