Another form of encrytion? "Not SSL"

[Leon]

How can I encrypted data sent across my website from web forms without using
SSL?
Such as on Login the user enter "EmailAddress" & "Password" and Simply
Registration Form
in which the user creates a Password, FirstName, LastName, etc.
I see site like Careerbuilder and Monster allow user to register, login, and
retrieve a lost password
without using a SSL connection "I Know anytime you deal with credit card
info you need a SSL.
Thanks!

 

[Daniel Fisher\(lennybacon\)]

You can use a javascript BigInt to encrypt dat before it's send and decrypt
it using BitInt in C# when it's submited.

 

[Joerg Jooss]

How can I encrypted data sent across my website from web forms
without using SSL?
Such as on Login the user enter "EmailAddress" & "Password" and Simply
Registration Form
in which the user creates a Password, FirstName, LastName, etc.
I see site like Careerbuilder and Monster allow user to register,
login, and retrieve a lost password
without using a SSL connection

So what makes you even think these sites are secure?

 

[Robert Hurlbut]

Leon,

If there is no SSL being done on the form, then your information is more
than likely sent clear text. Now, they could be using SSL with a form post,
which would be secure, and you can tell this through "view source" on the
page. Even with SSL, though, just because the lock is there in the corner
doesn't always mean it is valid. You still have to check it.

Also, if you are able to get your password back from any site without them
re-generating a temporary password, then that site is probably storing your
password in clear text, or at best encrypting it with some key they use to
decrypt it. Ideally, you want the site to use a salt and one-way strong hash
to store your password, which means you can't ever retrieve the same
password.

Robert Hurlbut
http://weblogs.asp.net/rhurlbut
http://www.securedevelop.net

 

[Leon]

So is it easy for a hacker to get personal information sent in clear text
across the web.

 

[Joerg Jooss]

So is it easy for a hacker to get personal information sent in clear
text across the web.

At least much easier than compared to using SSL ;-)

 

[Leon]

but the network itself provide somewhat type of security during the process
of the clear text information passing across the web?

 

[Robert Hurlbut]

Anything sent over a network without SSL or some other form of encryption is
in "clear text" form and can be viewed through a standard network sniffer.

Robert Hurlbut
http://weblogs.asp.net/rhurlbut
http://www.securedevelop.net

 

[Leon]

what' a network sniffer?
A Program that...

Anything sent over a network without SSL or some other form of encryption
is in "clear text" form and can be viewed through a standard network
sniffer.

Robert Hurlbut
http://weblogs.asp.net/rhurlbut
http://www.securedevelop.net

 

[Ken Schaefer]

program that captures and allows examination of packets travelling on the
network: eg www.ethereal.com

Cheers
Ken

 

[Leon]

But don't still need access to the network to use the sniffer, or can you
get to the network through www.somename.com?