Hi,
I work for a company that awarded an IT company a contract to develop a website for us using ASP.NET. And while we were doing the acceptance testing we found that authentication information gets sent over unsecure connection. (It doesn't use SSL)
That IT Company says that only thing to do to secure the login form using SSL is configure the IIS to secure that page using SSL. I actually don't think that is totally true, but it's partially correct.
Go to the complete details ...