Home/ Questions/Q 6722757
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T09:29:06+00:00

I’m following the example on http://marakana.com/blog/examples/php-implementing-secure-login-with-php-javascript-and-sessions-without-ssl.html The thing I don’t fully understand is what

  • 0

I’m following the example on http://marakana.com/blog/examples/php-implementing-secure-login-with-php-javascript-and-sessions-without-ssl.html

The thing I don’t fully understand is what is the gain by doing this? The secret word is posted in the form, so anyone who might be sniffing would surely see that secret word, as well as the javascript and be able to figure out the password anyways. Does it really make sense to do this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    An eavesdropper would not be able to derive the password, because they only know:

    • the secret word
    • the hash of the secret word/password combination

    Since hashes are one-way, you cannot derive the password itself from these.

    What you gain: The user has set up a password which the server is able to verify, without having to send the plaintext password itself.

    • 0