Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I want to create a secure login, so I want to encrypt the password before I send it as POST parameter. I am doing it with a SHA1 javascript function.
Then I realize that if someone intercepts the encrypted password, he can use it right away. Sending it as a post parameter the same URL.
How can I be sure that the password comes from the login input field? Maybe with a PHP session? I don’t want to use secure http yet. Anyone has a simple alternative?
You can’t.
The closest thing to that is the usual defences against CSRF … but that will only stop people tricking users into submitting data from their site to your site. It won’t protect passwords.
HTTPS is the simple option.