Default options don't secure login?

I assume you log in through user because you've disabled the login block ?

do you get an https when using the block ?

while it may not be relevant for you, it is relevant to the request and your question about whether or not it should be a default setting.

How would I secure login with this module?

I'd think you would want to investigate the securelogin.module

The v6.x-1.7 release secures the user/* pages by default.

fletchgqc: Correct. I've attached a tiny patch for the D6 branch to add it in. It also separates the main admin page vs the sub-pages, to have them listed in the same format.

I applied the patch listed in comment #10 to version 6.x-1.8 of the module. It applied without any trouble and appears to work as advertised. I think it is an important patch because someone who just accepts the defaults after installing this module could easily be under the mistaken impression that user logins are secure, when they may not be.

subscribing
will this patch be committed to the core Secure Pages module?

subscribing, +1 for commit

[EDIT]: Please ignore my earlier comments which are below. I have tested this again from scratch. The first thing I did was make sure that no wysiwyg editor was on in the securepages configuration. Then everything is fine. The default pages to secure and ignore appear on separate lines and the user/* seems to work but I had to add user* for cases when the url http://example.com/user is used.

Thanks for the module.

Izzy

[/EDIT]

Previous comments to disregard:

Just using securepages module for the first time. Thank you very much.

I'm also glad that I found this issue.
I am using Logintoboggan and even though it is configured to link to the login page I was having trouble getting that to be secured over SSL if I have the switch to non-secure checkbox selected.

I tried "user" but this did not work neither did "user/*", however "user*" seems to work. Not sure why?

I also found I had to edit the securepages configuration so that each item was on a separate line instead of all on a single line. I may have to test this further to confirm.

Thanks,

Izzy

subscribing, have the same issue

* I have committed this to dev.