Question

If a password is encrypted before ajax, what is to stop a hacker from capturing the encrypted password and using it to log in?

Should a unique salt be sent from the backend beforehand?
Wouldn’t a hacker be able to capture that too?

background to my question:
I worked through this tutorial
http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL
summary of tutorial
browser side encrypts password before sending it to backend where it is stored in db

From that link, the first comment stuck in my mind
“what’s to prevent a hacker from capturing the hashed password and logging in?”

Answer 1

Nothing. Hashing the password on the client is a terrible idea.

Communication between the browser and server should be properly encrypted using SSL (via HTTPS).

Hashing on the client side has two effects:

• It provides a false sense of security to the site owner by suggesting that it can substitute for SSL
• It adds a dependency on JavaScript