Question

I’m running a dating site and not using SSL at the moment.

I’ve noticed major sites like facebook and twitter do not use https for login but just use plain old http, is there really any advantage to https-ing my site or it is only for cc transactions or so ?

thanks in advance.

Answer 1

Actually, facebook does use https for its login:

<form method="POST" action="https://login.facebook.com/login.php?login_attempt=1" id="login_form">

as does twitter:

<form method="post" id="signin" action="https://twitter.com/sessions">

You’ll notice they don’t use https for the page that displays the signin form. That’s because it isn’t necessary.

However, it’s a good idea to use ssl the login itself if you can, if only because so many users employ the same password for all sites.

One solution, which I’d like to see more sites employ, is using OpenID/OAuth for login instead of requiring a username/password.