news:537453A7-F9AC-49C0-8DE1-EC2D6493AFDF@microsoft.com...
> Hi All,
>           An organization has a website which goes with windows
> authentication to access their website and this website is accessed by
> their
> employee around 60,000 and accessed with a frequency atleast once in a day
> or
> more. They use https:// throught the website, Does is necessary ??? please
> help me with supporting documents.
>
> one more question, Can anyone hatch when i use http:// ?, should i go for
> https://?
>
> Thanks in advance,
>
> Ananth Ramasamy Meenachi
>

> It depends.  If they use Basic authentication then it is absolutely
> necessary to protect the password of the user.  If they use IWA, then
> it is not necessary for that, but it may be necessary to protect the
> data that they website is providing.  The company may have policies
> which require that no one be able to eavesdrop on the data.  I think
> that is totally reasonable.
>
> There are also some security experts who suggest that NTLM hashes are
> not difficult to crack, so using NTLM without encryption is a bad
> idea. Kerberos is stronger in this regard, but may not be what they
> are using for Windows auth.
>
> Have you asked them why they use HTTPS?
>
> Joe K.
>

"Joe Kaplan" wrote:

> It depends.  If they use Basic authentication then it is absolutely
> necessary to protect the password of the user.  If they use IWA, then it is
> not necessary for that, but it may be necessary to protect the data that
> they website is providing.  The company may have policies which require that
> no one be able to eavesdrop on the data.  I think that is totally
> reasonable.
>
> There are also some security experts who suggest that NTLM hashes are not
> difficult to crack, so using NTLM without encryption is a bad idea.
> Kerberos is stronger in this regard, but may not be what they are using for
> Windows auth.
>
> Have you asked them why they use HTTPS?
>
> Joe K.
>
> --
> Joe Kaplan-MS MVP Directory Services Programming
> Co-author of "The .NET Developer's Guide to Directory Services Programming"
> http://www.directoryprogramming.net
> --
> "Ananth Ramasamy Meenachi"
> <AnanthRamasamyMeena***@discussions.microsoft.com> wrote in message
> news:537453A7-F9AC-49C0-8DE1-EC2D6493AFDF@microsoft.com...
> > Hi All,
> >           An organization has a website which goes with windows
> > authentication to access their website and this website is accessed by
> > their
> > employee around 60,000 and accessed with a frequency atleast once in a day
> > or
> > more. They use https:// throught the website, Does is necessary ??? please
> > help me with supporting documents.
> >
> > one more question, Can anyone hatch when i use http:// ?, should i go for
> > https://?
> >
> > Thanks in advance,
> >
> > Ananth Ramasamy Meenachi
> >
>
>
>

news:2DF5628E-75CE-4731-99C4-049C07A6535A@microsoft.com...
> Hi,
>
> I believe that one of these Certification's (SEI-CMM Level 5 Certificate,
> latest ISO 9001:2000 Certificate, BS7799 Certificate and PCMM
> Certificate.)
> must have insisted to use SSL for Data Security in all the official
> websites.
> I do think that these people must have misunderstood it, by implementing
> https:// through the website. Since the company has enormous bandwidth for
> future expansion, they don't find any problem in encrypting and
> de-encrypting
> the same for about 60,000 users per day as minimum request.
>
> I request you to provide your valuable suggestion for 60,000 user's using
> https:// just for static pages and also they have implemented the same in
> more then 20 website which are dynamic and used by the same users.
>
> Ananth Ramasamy Meenachi
>
> "Joe Kaplan" wrote:
>
>> It depends.  If they use Basic authentication then it is absolutely
>> necessary to protect the password of the user.  If they use IWA, then it
>> is
>> not necessary for that, but it may be necessary to protect the data that
>> they website is providing.  The company may have policies which require
>> that
>> no one be able to eavesdrop on the data.  I think that is totally
>> reasonable.
>>
>> There are also some security experts who suggest that NTLM hashes are not
>> difficult to crack, so using NTLM without encryption is a bad idea.
>> Kerberos is stronger in this regard, but may not be what they are using
>> for
>> Windows auth.
>>
>> Have you asked them why they use HTTPS?
>>
>> Joe K.
>>
>> --
>> Joe Kaplan-MS MVP Directory Services Programming
>> Co-author of "The .NET Developer's Guide to Directory Services
>> Programming"
>> http://www.directoryprogramming.net
>> --
>> "Ananth Ramasamy Meenachi"
>> <AnanthRamasamyMeena***@discussions.microsoft.com> wrote in message
>> news:537453A7-F9AC-49C0-8DE1-EC2D6493AFDF@microsoft.com...
>> > Hi All,
>> >           An organization has a website which goes with windows
>> > authentication to access their website and this website is accessed by
>> > their
>> > employee around 60,000 and accessed with a frequency atleast once in a
>> > day
>> > or
>> > more. They use https:// throught the website, Does is necessary ???
>> > please
>> > help me with supporting documents.
>> >
>> > one more question, Can anyone hatch when i use http:// ?, should i go
>> > for
>> > https://?
>> >
>> > Thanks in advance,
>> >
>> > Ananth Ramasamy Meenachi
>> >
>>
>>
>>