Security On GET

[Martin Cunningham]

Hi. I've a form the has a password filed in it. How can I encrypt it so when
i use a get it doesn't show what the actual password is but in stead a
jumble of rubbish that can be sorted out in the next file?
Thanks.

 

[rf]

Hi. I've a form the has a password filed in it. How can I encrypt it so when
i use a get it doesn't show what the actual password is but in stead a
jumble of rubbish that can be sorted out in the next file?
Thanks.

You can't. You should be using method="post" and SSL.

Cheers
Ricard.

 

[Rob McAninch]

The client would have to encrypt the password before sending it,
the browser isn't going to do that automatically. So the client
would have to type the 'jumble of rubbish' instead of the
'password', but now the jumble is transmitted in the open - and
effectively _is_ the password.

You can't. You should be using method="post" and SSL.

Yup. The whole transaction has to be encrypted, not just a piece
of it.

 

[Toby A Inkster]

The client would have to encrypt the password before sending it,
the browser isn't going to do that automatically. So the client
would have to type the 'jumble of rubbish' instead of the
'password', but now the jumble is transmitted in the open - and
effectively _is_ the password.

Well, not neccessarily. The server would just need to send a unique
"salt" each time it asked for the password. The password and salt would be
concatenated together and then hashed. This hash could be used to log in,
but if intercepted would not be any use because it is unlikely that the
same salt would be sent next login.

 

[Rob McAninch]

Toby A Inkster

The client would have to encrypt the password before sending
it, [...] but now the jumble is transmitted in the open - and
effectively _is_ the password.

Well, not neccessarily. The server would just need to send a
unique "salt" each time it asked for the password. The
password and salt would be concatenated together and then
hashed. This hash could be used to log in, but if intercepted
would not be any use because it is unlikely that the same salt
would be sent next login.

Hm, I see how that would work. The client would still have to do
the hash correct? So it would take some extra software, and
couldn't be for general use (like SSL could be) as I understand
it.