It seems that using SSL after the password is entered is pointless, as an attacker can already intercept the connection and get the login details.
No, the credentials itself would usually be transferred securely. Before your browser sends anything out a SSL/TLS connection is established, which is then used for the actual application data. Note however, that this is only true in case there is no active man in the middle manipulating the site or login form.
Nevertheless, I don't think that there are any compelling reasons in this day and age not to encrypt everything. This has a couple of advantages over any sort of mixed approach.
First of all it is much harder to mess things up. There have been enough examples in the past, where the login itself was secured, but the session cookie for intance, was not. Firesheep was famously exploiting this to hijack sessions and a lot of big players were vulnerable to this type of attack.
Another common attack are stripping attacks. You may very well serve all of your links via a secure connection, but a man in the middle can basically try to replace every occurrence of https
with http
. sslstrip is tool doing this automatically on-the-fly and its up to your server configuration to block these requests.
Additionally, you can make use of HTTP Strict Transport Security when serving your content via SSL/TLS only. This makes absolutely sure that browsers won't even bother trying to connect to your service without establishing a secure connection in the first place.
Another important thing to note is that you can't be certain the site hasn't been tampered with by an active man in the middle. Obviously enough such an entity could manipulate the form itself in a way that your browser would indeed send out your credentials unencrypted or to somewhere completely different, rendering your whole authentication scheme useless.
However, there is another point, which at least in my view is the most important one. By exclusively offering your service via SSL/TLS you are effectively securing the privacy of your users to a certain degree. This is something Edward Snowden has mentioned just recently in his TED talk. He gave the example that you can't buy a book from Amazon without the government knowing about it, because Amazon is serving most of their sites via simple HTTP and only uses HTTPS for the checkout itself. This is true for most sites, and it is a shame, because it basically means that the governments of this world always know what you are up to.
Back in the day it was argued that performance is an issue, which was the most prevailing argument against using SSL exclusively. I don't think this is true anymore. These days it is relatively cheap to get extra performance and SSL/TLS are both optimized in a way so that previously negotiated connections can easily be reused.