Right, so typical webform encryption (https) serves two purposes:
- To send the info over the wire encrypted
- To assure the user of the identity of the server via the certificate trust chain
- To prevent http tampering of the form
Sometimes you get https forms posting on http sites which means only #1 is being fulfilled, which is better than nothing I suppose.
The thing is - can you do #1 without the cost and administration of https entirely?
I'm not saying this is a wonderful implementation, but aside from the browser not being able to identify a secure form of this method - it at least protects user data over the wire at development, rather than certificate cost.
So why have I never heard of this implementation?