Password Security

[Brit]

I have noticed a number of internet sites have the userid/password login screens on secure (https) pages while some sites have the login on a non-secure page that posts to a secure page. Is there a difference?

Does the browser encrypt all posts to secure pages even if the originating page is not secure?

Any help is appreciated.

 

[Tarwn]

Here is the deal.
If you have a login page (or any page for that matter) that is not a secure page, the browser sends the form information back to the server as plain text, regardless of what security is on the next page. That means that anyone on the same network using a packet sniffer can easily read the username/password straight out of the packet because it is not encrypted at all.
If the login page is secured, then the form info is sent encrypted and cannot be read.