ASP.Net provides different ways to login and Sitefinity utilizes them:
When considering a login method, you need to consider the importance of the data you are protecting. However, you also need to consider the privileged operations as well.
So you determined that you need to protect your information and privileged operations behind a login screen... but how secure is the login process?
Did you know that non-SSL logins pass usenames and passwords as PLAIN TEXT over the Internet?
People have a false sense of security thinking that an Active Directory login without SSL is secure. As a matter of fact...
Active Directory logins without SSL can be more dangerous than Forms Login without SSL.
This is because Forms login is typically isolated to that specific application, while an Active Directory login could give the fort away for privileged access to an entire company's infrastructure and core systems.
SSL should be used on all login screens, but SSL needs to be applied to all web pages that execute privileged operations and/or display sensitive data:
Web pages without SSL can be captured by anyone monitoring the Internet, especially in public places (ex. Wi-Fi hotspots, Internet cafes, hotel networks).
We recommend SSL for ALL pages and operations that a login protects.
along with strict password creation rules:
We recommend all of the above restrictions.
If you have further questions, please contact us at Automated Results
RadEditor - please enable JavaScript to use the rich text editor.
I often get asked why I'm willing to journal all of my Sitefinity discoveries. People think I'm insane to give away for free what I labored over at some point.
Let me answer that in 2 parts:
Talk to us about how we can help YOU!
Keep up with our Sitefinity discoveries! Click on the RSS feed icon below or sign up for our newsletter.