Re: Encryption Question

David Dorward wrote:

egg...@xxxxxxxxx wrote:
I have a form where a user can change his password,
but I'm confused on how to prevent this from being
transmitted in plain text.

Run the request over HTTP with SSL (HTTPS) not plain old HTTP.
JavaScript isn't relevant to the issue.

A plain javascript solution is possible without need for HTTPS.

http://groups.google.com/group/comp.lang.javascript/msg/096d1191285a15a4

- let user type new password
- encrypt it using javascript (see link above)
- send encrypted string over HTTP and store it
- re-authentication based on same algorithm (handled at server or
client)

The algorithm of the script above corresponds to the default crypt
function on UNIX. This means that the password must be stored as an
encrypted string too - which is certainly recommended, and it seems
that the original poster isn't doing this. A safe password encryption
must always be non-reversible.

--
Bart

.

Relevant Pages

  • Re: Real Software Please Explain Your Spyware Program - Warning: Do Not Try Demo!
    ... since HTTP is used to send the data. ... if you were that paranoid, you'd snoop the data and notice that it's ... plain text. ...
    (comp.lang.basic.realbasic)
  • Re: Encryption Question
    ... Run the request over HTTP with SSL not plain old HTTP. ... JavaScript isn't relevant to the issue. ...
    (comp.lang.javascript)
  • Can you send plain-text message Via OWA?
    ... I have an annoying user who wants to send 2k3 OWA email ... messages in plain text, not HTTP. ...
    (microsoft.public.exchange.clients)
  • Re: Encryption Question
    ... A plain javascript solution is possible without need for HTTPS. ... re-authentication based on same algorithm (handled at server or ... encrypted string too - which is certainly recommended, ...
    (comp.lang.javascript)
  • Re: https dialog
    ... I had asked previously at a java group, ... I don't want to use javascript for my task. ... why are bothering with the low-level HTTP communication and especially ... As I said in my first post for say ajaxoid or plain old ...
    (comp.lang.javascript)