Secure Login credential without using SSL

Question

I am new in SSL, whatever i read and know that its paid digital certificate and after using SSL in website https:// the data transfer is secure at network layer.

In my application i don't have much security concern except loginname and password.

Is there any way to protect Loginname and password without using SSL https://

Answer 1

There are a number of authentication schemes which can work securely over plain HTTP. The most common of these is Digest, which is supported by all major web browsers and virtually every web programming framework.

The down-side of using Digest for web sites is that:

• The authentication is handled by the browser itself rather than a login page on the web site, which doesn't look nearly as nice, and doesn't allow you to have all the surrounding helper functions like "forgot your password?" that we've come to expect nowadays.

• If you have no SSL connection, savvy users may feel worried that they are sending their password insecurely (even though they aren't) because they've been trained to look for an SSL connection when entering credentials.

There are other schemes such as OAuth which also are safe over plain HTTP, but that is really more for APIs than web sites, so probably isn't what you want.

Answer 2

There is NO alternative to HTTP security in a browser other than using SSL for every page where the user is logged in. Any other techniques are completely insecure and are nothing but layers of obscurity.

Any homebrew solution over HTTP is always vulnerable to MITM attacks, among other vulnerabilities.

Even with SSL, the login & session mechanism must be secure or it can be cracked using other exploits.

Answer 3

The certificate may be a self signed one. Not necessarily to be a paid one :)

Answer 4

You can also try StartSSL.Org I am using that currently and it works great even but it somehow the same as cacert.org, they are not trusted by the browsers by default