text: if a user uses (http over ssl) over encrypted channel, is the user still vulnerable to spyware tt obtain p/w? if a user uses https (http over ssl) over encrypted channel, is the user still vulnerable to spyware that uses trojan horse backdoor to obtain the user's login id and password when accessing internet banking? in a word, yes. encryption only covers the transit between your computer and the bank's.  its purpose is to protect against malicious third parties on the network, packet sniffing and listening to connections.  once the data gets to the end computer (either end), it has to be decrypted in order to be of any use.  cleverly-written trojans could snoop the password before it was encrypted or after it was decrypted.