Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17070

Re: HTTPS data in a form

Path csiph.com!2.us.feeder.erje.net!feeder.erje.net!1.eu.feeder.erje.net!weretis.net!feeder4.news.weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups comp.lang.php
Subject Re: HTTPS data in a form
Date Mon, 19 Sep 2016 23:36:01 +0200
Organization PointedEars Software (PES)
Lines 26
Message-ID <2008259.ElGaqSPkdT@PointedEars.de> (permalink)
References <e8880b4e-3407-4166-abf5-cadeae30c633@googlegroups.com> <qXADz.49742$e%3.5189@fx07.iad>
Reply-To Thomas 'PointedEars' Lahn <php@PointedEars.de>
Mime-Version 1.0
Content-Type text/plain; charset="UTF-8"
Content-Transfer-Encoding 8Bit
X-Trace solani.org 1474320962 10344 eJwFwQkBgAAIA8BK45c4gK5/BO/CUvLKM9KDwTmpM9nAcaAOzMF2RIrvB2vWg4zV63bl/h7dEQ4= (19 Sep 2016 21:36:02 GMT)
X-Complaints-To abuse@news.solani.org
NNTP-Posting-Date Mon, 19 Sep 2016 21:36:02 +0000 (UTC)
User-Agent KNode/4.14.2
X-NNTP-Posting-Host eJwFwQEBwCAMAzBLHdCyy+Fj9S+BhFOh2kvUomkUZogZyIsm/24PmFe46WF9vWMcsE6Q9gMOwRD3
Cancel-Lock sha1:TQ9b4UCaW5kxUM62kBe0RCye258=
X-User-ID eJwNysEBwEAEBMCWcCGnHJbtv4Rk3uMnNPA+4fE4nThgzKonT+SgAnYbKys6xjUIRqxvBqa8gSz+PwmWoj+NTBfF
Xref csiph.com comp.lang.php:17070

Show key headers only | View raw

Richard Damon wrote:

> If you don't want to use HTTPS, but normal HTTP, then as others have
> said, you would need some client side code, likely javascript, to
> encrypt the field before being sent. One warning, unless you are REAL
> careful in how you do this, it may just add a false sense of security,

They are *definitely* “[adding] a false sense of security” if they do this.

> as you are still totally susceptible to man-in-the-middle attacks 

If they do this, MITM attacks are the least of their problems.  *Everybody* 
can brute-force their way in because they are literally *handed the keys*.

> and unless you are really careful to salt the login page, and make sure
                                       ^^^^^^^^^^^^^^^^^^^
> the salt matches, someone eves dropping can still just return the same
> encrypted password to get access.

ROTFL.  You have no clue what you are talking about.

-- 
PointedEars
Zend Certified PHP Engineer 
<http://www.zend.com/en/yellow-pages/ZEND024953> | Twitter: @PointedEars2
Please do not cc me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

HTTPS data in a form bit-naughty@hotmail.com - 2016-09-15 21:45 -0700
  Re: HTTPS data in a form "J.O. Aho" <user@example.net> - 2016-09-16 07:52 +0200
  Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-17 15:57 +0200
    Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-17 21:17 +0200
      Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-17 17:02 -0400
        Re: HTTPS data in a form "Peter H. Coffin" <hellsop@ninehells.com> - 2016-09-21 11:33 -0500
          Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-23 08:47 -0400
          Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-24 22:11 +0200
      Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-19 21:36 +0200
        Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-19 23:28 +0200
          Re: HTTPS data in a form "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-09-19 23:44 +0200
            Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-19 23:57 +0200
              Re: HTTPS data in a form "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-09-20 19:00 +0200
          Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-19 21:00 -0400
          Re: HTTPS data in a form Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2016-09-20 05:59 +0000
            Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-20 15:40 +0200
              Re: HTTPS data in a form "J.O. Aho" <user@example.net> - 2016-09-20 18:39 +0200
                Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-20 14:36 -0400
              Re: HTTPS data in a form Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2016-09-20 21:04 +0000
                Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-24 21:58 +0200
                Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-26 19:43 +0200
              Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-23 09:14 +0200
                Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-24 22:00 +0200
                Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-26 19:44 +0200
          Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-20 08:20 +0200
            Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-20 15:41 +0200
              Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-23 09:02 +0200
                Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-24 22:06 +0200
                Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-26 19:49 +0200
  Re: HTTPS data in a form Richard Damon <Richard@Damon-Family.org> - 2016-09-18 14:22 -0400
    Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-19 23:36 +0200
      Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-19 21:03 -0400
  Re: HTTPS data in a form "Peter H. Coffin" <hellsop@ninehells.com> - 2016-09-21 11:29 -0500

csiph-web