 |
 |
It is strongly recommended that any authentication be encrypted. The preferred method of authentication is through Sentinel. An alternative method for authentication that is becoming more popular is Shibboleth. SSL encryption does not prevent a man-in-the-middle attack if the web site is recording the user name and password. It is a good idea to ensure MSU netid authenticated web applications use SSL encryption. However, some web applications can not use SSL for technical reasons. -- Joe Budzyn [log in to unmask] 301 Computer Center Ph: (517) 432-7448 Michigan State University East Lansing, MI 48824 On Wed, Apr 09, 2008 at 11:04:35AM -0400, Tom Rockwell wrote: > Hi, > > Is there a requirement that websites that use netid for authentication > be ssl encrypted, or at least perform the authentication using ssl? > > Given that several MSU websites that use netid for authentication allow > access to personal information, I'm wary of using netid over a plain > text link. Note that the non-encrypted site is not an official MSU site. > > Thanks, > Tom