Question: On some websites, the login page (where you enter your login details) is served by a regular HTTP connection with no encryption. However, once I login, the page immediately switches to a secure HTTPS connection when displaying my account details, etc. It seems that using SSL after the password is entered is pointless, as an attacker can already intercept the connection and get the login details. Is securing the data after the login is entered have any security benefit whatsoever, or is it just a false sense of security?

An example of this is the [Corsair Force](http://corsair.force.com/) website.

Answer: 
> 
> It seems that using SSL after the password is entered is pointless, as an attacker can already intercept the connection and get the login details.
> 
> 
> 

No, the credentials itself would usually be transferred securely. *Before* your browser sends anything out a SSL/TLS connection is established, which is then used for the actual application data. Note however, that this is **only true** in case there is no active man in the middle manipulating the site or login form.

Nevertheless, I don't think that there are any compelling reasons in this day and age not to **encrypt everything**. This has a couple of advantages over any sort of mixed approach.

First of all it is much harder to mess things up. There have been enough examples in the past, where the login itself was secured, but the **session cookie** for intance, **was not**. [Firesheep](http://codebutler.github.io/firesheep/) was famously exploiting this to hijack sessions and a lot of big players were vulnerable to this type of attack. 

Another common attack are **stripping attacks**. You may very well serve all of your links via a secure connection, but a man in the middle can basically try to replace every occurrence of `https` with `http`. [sslstrip](http://www.thoughtcrime.org/software/sslstrip/) is tool doing this automatically on-the-fly and its up to your server configuration to block these requests.

Additionally, you can make use of **[HTTP Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)** when serving your content via SSL/TLS only. This makes absolutely sure that browsers won't even bother trying to connect to your service without establishing a secure connection in the first place.

Another important thing to note is that you can't be certain the site hasn't been tampered with by an **active man in the middle**. Obviously enough such an entity could manipulate the form itself in a way that your browser **would indeed send out your credentials unencrypted or to somewhere completely different**, rendering your whole authentication scheme useless.

However, there is another point, which at least in my view is the **most important** one. By exclusively offering your service via SSL/TLS you are effectively securing the **privacy of your users** to a certain degree. This is something Edward Snowden has mentioned just recently in his [TED talk](https://www.ted.com/talks/edward_snowden_here_s_how_we_take_back_the_internet). He gave the example that you can't buy a book from Amazon without the government knowing about it, because Amazon is serving most of their sites via simple HTTP and only uses HTTPS for the checkout itself. This is true for most sites, and it is a shame, because it basically means that the governments of this world always know what you are up to.

Back in the day it was argued that performance is an issue, which was the most prevailing argument against using SSL exclusively. **I don't think this is true anymore**. These days it is relatively cheap to get extra performance and SSL/TLS are both optimized in a way so that previously negotiated connections can easily be reused.
If you take a look at the form posting your login details you will see the following:

```
action="https://corsair.secure.force.com/SiteLogin?refURL=http%3A%2F%2Fcorsair.force.com%2F

```

This action is in fact posted over SSL/TLS. In an ideal world, the whole site is SSL. Currently, for the site in question, the login details are posted over a secure channel.

An attack vector could be a MiTM (man-in-the-middle) attack. For example, when you hit the login page, they could inject another action into the form element. 

To answer the question, SSL provides the benefit that data transmitted cannot be viewed or tampered with by a 3rd party. SSL on a site after the login crediential were passed would still provide the above security measures. Obviously your credentials would now be known to an attacker, who could then log in as you.