Security help!

[Mathew Michuta]

I am going to use webservices extensively in my vb windows
forms application. I will be exchanging lots of data over
the internet in my distributed app. I purchased a
certificate from verisign to encrypt it via https.

My questions are these:

1. At what point does the https protocol encrypt the data?
Does it encrypt inside the CLR, or just before it hits the
ip subsystem, or does it send the webservice request THEN
encrypt it?

2. Each of my webservice function calls receives a userid
and password in addition to any data it is carrying to
ensure that the user has permissions to that function.
Should I encrypt the userid and password inside my code,
or is the https protocol sufficient to protect this
security information?

3. I have read about the issue with the ease of CLR code
being a double edged sword being that it is easy to
dissassemble or reverse engineer the program. Is there any
way I can see the CLR code to see how much of my security
conventions are exposed in the CLR? I also don't want
people to be able to steal my design of course.

Thanks!