Short answer: No. Slightly longer answer: If you use SSL on the login page, how do you maintain state between requests over non-SSL sessions? If you just SSL e

Short answer: No. Slightly longer answer: If you use SSL on the login page, how do you maintain state between requests over non-SSL sessions? If you just SSL encrypt the logon you're given a cookie. If you send that cookie over HTTP, the end user is susceptible to more or less the same issues as before, only instead of the account being compromised, it's the session (until it expires). The user can mitigate this by logging out, in which case compromise is limited to the session, assuming that the adversary doesn't have the ability to intercept and block the logout request (which they most likely would in an intercept situation).