title: Secure authentication without SSL
body: <p>I'm starting to write a small web application and have started thinking about securing login (only used for administration).</p>
  
  <p>If I could, I'd install a CACert or self-signed SSL certificate, since for now I'll be the only one logging in, but my host isn't too accommodating.</p>
  
  <p>Are there any reasonable options for securing the site without SSL? I've been thinking about options for authentication:</p>
  
  <ol>
  <li><p>Implement a salted hash in JavaScript. When the login page is loaded, generate a salt server-side. Send it to the client in the clear and store it in a session variable.</p></li>
  <li><p>Digest authentication. I just found this idea browsing SO, and it's probably a lot more reasonable than rolling my own auth.</p></li>
  <li><p>OpenID. It's an open standard, no passwords are required (and I can "hijack" my OpenID provider's SSL to add security to the login process), but I have no idea how OpenID works or how secure it is. (Needs research. For example, can an OpenID authentication be replayed?)</p></li>
  </ol>
  
  <p>The problem with all of these is that:</p>
  
  <ul>
  <li>Sessions can be hijacked</li>
  <li>Only login is secure, everything else is in the clear</li>
  </ul>
  
  <p>The only option I can think of for securing the app after login is some disgusting JavaScript and PHP sending encrypted blobs of ASCII back and forth. I don't want to do this.</p>
  
  <p>Is there any encryption (for pageloads and POSTs) that can be implemented in my server-side scripting language of choice without the blessing or involvement of my host, but that would be supported by the browser? Can sessions be secured from hijacking (practically) without SSL?</p>
  
  <p>What would you do in a situation like this?</p>