said by nwrickert :

The secure login form is transmitted using https, so the login is secure.

quote:

---

Steve: Well, exactly. And that's the point, is it's the concentration effect that individual end users could all be negotiating these SSL connections with no problem. But a server that's handling tens of thousands of connections per second, suddenly it ends up just collapsing. So the good news is, servers today, processors today are far faster. This is why there are so-called "SSL accelerators." You can buy SSL hardware that does this very expensive public key handshake in hardware to offload the burden from the server software because it's traditionally been so expensive.

---

quote:

---

One of the changes in HTTP 1.0, because it was recognized that this was dumb, if we had a lot of transactions back and forth as we walked around interacting with a single site, why keep bringing up and dropping these connections? So the HTTP 1.0 model, and that's a little agreement in the query that the browser makes that says I'm using what protocol version, and so all browsers now support HTTP 1.1, it'll say this is what I'm using. And in one of the headers they'll say, I'm willing to keep this alive. And so it's a keep-alive header. So the server says, oh, whew, thank you. And so the spec says that a client, a web client, can and will have a maximum of two connections at a time to the remote server. And it's able to reuse them. So the client is able to send a stream of queries down those connections and receive a disambiguated stream of responses back. So in that model it's much less expensive to establish two connections which are SSL because now they're persistent.

---