That's non-sequitur. Better on-line identity will not solve problem of unencrypted traffic. Any identity solution will be vulnerable unless: Browser expects to get secure protocol and will refuse to fall back to an older one. Without this you can do MITM swapping new, secure protocol for old leaky one (e.g. replace Digest authentication with Basic auth). Browser can verify identity of server using other/trusted communication channel (SSL does that by storing CA certificates offline). Without this you'll be securely sending your identity to an attacker spoofing a server. All traffic has to be encrypted and tamper-proof. If you only protect identity, then attacker performing MITM can perform replay attack, change request parameters, steal data, etc. — you're still exposed to lot of risks.