Re: Form authentication security question!

Hi,

No, hash value of the password is created on the server after client send it
as a plaintext. The reason why are passwords stored as a hashes is to
prevent it's misuse when the database is hacked, not to transmit them
securely. So yes, form manipulation would be successfull.

Btw. I don't think that login controls would use MD5 - it's unsecure,
deprecated alghorithm.

"jens Jensen" <jens@xxxxxxxxx> pí¹e v diskusním pøíspìvku
news:e7KgENTOGHA.2236@xxxxxxxxxxxxxxxxxxxxxxx

Hello,
When my users logs in to my site, an MD5 hashed value of the password is
sent to the server, and there the value is validated against a database.

What if someone catchs my hash value and also send it to my server. Will
that form manipulation succeed?


Many thansk in advance

JJ



.

Relevant Pages

  • Securing a website...storing hashed passwords?
    ... security for a web site that presumably won't have an SSL option. ... The server will supply a random value to a login page. ... with the random value and create an MD hash. ... database are obviously a nono. ...
    (comp.security.misc)
  • Re: Encryption Question
    ... No encryption needed at server side, ... However, if a 'hash' of the password is sent in plain text over HTTP, and ... all the server knows is the 'hash' of the password, ... in the mysql database as SHA1 hash. ...
    (comp.lang.javascript)
  • Re: criticism of web based password manager requested
    ... What about an active snooping attacker (including an untrusted server) ... store any padding in the entries and don't use message authentication. ... > the verification hash is never passed out. ...
    (sci.crypt)
  • Re: Proposal for Lite Encryption for Login Form without SSL
    ... the form uses javascript to hash the password ... This way the password is not sent to the server ... This would be the equivalent to a public key in public key encryption ...
    (comp.lang.php)
  • Re: Proposal for Lite Encryption for Login Form without SSL
    ... the form uses javascript to hash the password ... This way the password is not sent to the server ... This would be the equivalent to a public key in public key encryption ...
    (comp.lang.php)