Hi.  I verified that the login process for our DNN site is insecure.  I used the Ethereal to capture the packets when I logged into our DNN site, and the user name and password are definitely sent as clear text.  Because of the security issue, we haven't made our site available to the public yet, and have chosen to use it as an internal Intranet site for the time being.  I want to go ahead and secure the login procedure, though, so we can make the site available to the public without the security risk of passwords being sent as clear text.  I suspect that I can setup the entire site to be SSL, but that may have a significant on performance.

Question 1) Has anyone else setup their DNN site to use SSL, and if so what kind of a performance impact did you notice?

Question 2) Has anyone been able to setup the login session to use SSL without having to make the entire DNN site use SSL?

Question 3) Has anyone used another method besides SSL to secure the login to their DNN site?

Thanks,
Van

We have the exact same issues and concerns.  Is there an answer to the login name and password being sent in clear text?  Or any way other than setting up the entire website to be SSL?

We can do that, but what about current links, bookmarks, search engine placement, etc.  That isn't a pretty picture. 

The easiest solution would be a way to ssl the login module.  Can that be done?

Thanks, anyone that has a solution to this, that would be awesome.

I've tested Mr. Mitchel's js by placing it in my default.aspx file of my instance folder - it does work, when the string 'login' is in the url the transfer protocol switches to https.  However my trouble lies with IIS itself in that I don't know how to install a certificate without the entire site requiring ssl.  I have a valid certificate in hand and I know how to go through the wizzard on the Direcotry Security tab on the website, I'm under the impression that this is going to require that all communication with this site be done using ssl.  I would like to pick and choose which dnn pages use ssl and not convert the entire site.  I've looked for a TID regarding this but I'm not having any luck locating instructions, can anyone here give me some direction?

Thanks much

Darin