I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL.
I've read plenty of security threads here, on StackOverflow, and elsewhere that goes on at length about regenerating session ids after n uses, and how your passwords need to be salted, hashed, and never stored in plain text. I've read plenty about how to detect when a session has been hijacked, by tracking IP addresses, user agents, and by using tracking cookies.
What I don't understand is what any of this matters when the website logs you in via a normal HTTP POST and sends your password over the wire in plain text?
I understand that all the other methods I listed are needed to reduce your overall exposure, and maybe there are some sites that just don't need that much security anyway, but I guess what I'm asking is:
- When is it ok to not bother with SSL?
Sites like Gmail, your bank, and LinkedIn, I can see having a reason to use SSL, but what makes it ok that sites like Facebook and reddit don't bother (hell, PlentyOfFish even stores your password in plain text and even emails it to you weekly as a reminder!?!)?
How concerned should I be with making sure SSL is setup (especially since I'd be starting with a shared host, and I'm being pretty cheap to start)? My site won't hold any particularly personal information, if that helps. If the site becomes a success, I'd seriously look at paying the extra for the added security.