True, there's nothing in protocol against it, and users can switch it off,
but if you're trying to sell something over the internet (which is the
reason a lot of poeple use SSL) then you really need to cater to the least
common denominator. Trying to explain frightening messages to the 60% or
whatever of your users who use Internet Explorer is not a good way to go
about that.
You shouldn't rely on users to "know" how to use SSL, since the technology
is far beyond most of their comprehensions. You should do everything
possible to ensure that the fewest number of people possible are presented
with any difficult or confusing questions, and "this site contains both
secure and insecure objects. do you want to proceed?" is *defintely* a
confusing question to the average user. It will absolutely cause an
e-businessperson to lose customers and there's no good reason to purposely
implement a site this way.
Jamie
At 03:13 AM 11/7/00, Owen Boyle wrote:
> > I would absolutely *not* do this, [mix SSL and non-SSL content] unless
> you want your web site users to
> > see a message from the web browser saying "this page has both secure and
> > insecure information. Do you want to proceed?" every time they user your
> > site. This does not instill confidence.
>
>Good point Jamie. However, for some users this may be necessary, there
>is nothing in the protocol against doing this, the browser warnings are
>browser-dependent (Netscape doesn't give a peep) and can be switched
>off. Users have to choose for themselves how they want to use SSL.
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
