Can https fallback to http and security level of https

问题

I am considering installing SSL/TLS for my domain. There are two questions that have been bothering me:

• Is there any scenario where a https connection can fallback to http? So, for e.g. if my ajax looks something like this

  $.post("https://foo.com", function(){ 
  
  });
  

  Is there any chance this could change to

  $.post("http://foo.com", function(){ 
  
  });
  

  and even if it does would my domain be still accesible at http://foo.com ?

• Next I have read extensively about using SSL/TLS and from what I have read it seems to be fairly accurate to assume that if I have this enabled and even if I send the user credentials in plain text, it's still secure (There would be encryption with salt and everything on the server of course). To what extent is this true and would creating a hash on the client and then sending it over https be any more secure?

Update: If sending plaintext over SSL is secure enough, then what really is the point of using things like cnonce ? Isn't it just unnecessary overhead on the client?

回答1:

1. No, HTTPS never falls back to HTTP automatically. It would take deliberate action by the user. If you're just going to a web page by putting its URL into the address bar, this is easy; for form submission it's harder.

2. Yes, sending plain text over SSL is fine. In fact, sending a hashed password doesn't really increase security much at all -- if someone manages to sniff the connection and gets the hashed password, that's all they need to be able to login to the site. It has one small advantage: if the user uses the same password at multiple sites, learning the hashed password for one site doesn't help them get into another site that uses a different (or no) hash. And it's not likely to be feasible to send salted hashes, since the client doesn't know the salt.

A cnonce adds an extra level of protection. If, somehow, someone manages to crack the SSL encryption, the cnonce prevents them from getting a usable password from it. This basically addresses the point I made above about why sending a hashed password doesn't help: what you need is something that changes from session to session, and a cnonce provides this.

See https://security.stackexchange.com/questions/3001/what-is-the-use-of-a-client-nonce

来源：https://stackoverflow.com/questions/17861798/can-https-fallback-to-http-and-security-level-of-https