Question

I am currently building a web/desktop application. The user can create an account online and login either online or via the desktop client.
The client will be built in Python and exported to exe.

I want to encrypt the password before it is sent online as the site has no https connection.

What is the best way to do this so the hashed password will be the same in python and php? Or is their a better way or should I just invest in https?

I have tried using simple hashing but php md5("Hello") will return something different to python’s hashlib.md5("Hello").hexdigest()

Answer 1

Forget this idea. Hashing the password on the client, sending the hash to the server and then compare it to the stored hash is equivalent to storing plain passwords in the database, because the hash becomes the password.

Or should I just invest in https?

Yes!