> How would you bootstrap a secure encrypted login for a user who was browsing the site without SSL? If you have a website where users sign in you are pretty m

> How would you bootstrap a secure encrypted login for a user who was browsing the site without SSL? If you have a website where users sign in you are pretty much left with SSL from the sign-in form on but you can move an indirection between the sign in and out so that a user has a chance to verify they are authenticating on the right site. Fundamentally there is no difference from the user's perspective for as long you are okay with moving the log-in box to a secure URL where the user can check the authentication.