Question

My question is simple regarding password security..

As a web application developer using PHP for example, I may design a html form that accepts a username and password and post them to the webserver using the POST method..

My question is:

1- When a user enters a password for this form on a web browser, does this web browser send the password over the network as plaintext and thus insecurely?

2-isn’t it possible that the web browser saves all passwords and sends them to the third party that design the web browser?

Thank you in advance

Answer 1

1. Yes, unless you’re using https, which encrypts everything sent between the server and the client.
2. Sure, but you could use a network sniffer to verify that the browser sends no information to third party servers.