Reasons to use SSL in ASP.NET are no different than in Classic ASP. When using SSL all packets sent across the wire are encrypted and this protects things like passwords and other secure data being exchanged between the browser and the server as it travels over the wire.

The risks of not using SSL are the same. If someone upstream from the router is able to sniff those packets they can obtain the unsecured payload including password and other sensitive data, whereas if its encrypted then the packets are of little use.

Now the reason you see many sites without SSL is because they don't want to pay for an SSL certificate and if the data would be of little value if stolen then its not as big a problem. I mean if someone manages to breach my little hobby site its not going to impact me as if they breached my bank. But this points out a good reason to not use the same password at your bank as you do at little hobby sites that may not be well secured.

Hope it helps,

Joe

Everthing sent over the wire including cookies is encrypted if using ssl. Even when not using ssl, nothing sensitive is stored in the cookie itself, its just an authentication token. The value in stealing it is not related to its contents but in the possibility of spoofing a priveleged user if you could convince the server that you are that user because you have that cookie. Passwords are never stored in the cookie for example.

In mojoportal, if SSL is available it will automatically use it on login, register, profile pages, but you can also specify to use it on all pages or on a per page basis depending on the nature of your content on those pages and whether it is sensitive data, you may want to use SSL on additional pages.

Hope it helps,

Joe