JScript MD5 function? (WAS "authorization idea (good or bad?)")

I've been following this thread... I too was thinking of having an entry for a 'manually managed' IP address. This was going to allow extended administration from a handful of IP's (machines). In my case, the username, password, AND IP would have to be true to allow administration type functions. But to my other question. I'm doing the MD5 comparison on the server (w/the database), but I want to avoid having the password sent 'in the clear'. Is there a JavaScript function that will do an MD5 on the client before sending it to the server? Would this (send MD5 passwords) actually help? (Can't a 'hack' capture and send the MD5 data just as easily as the cleartext?) Is SSL easier? (establish a secure connection, then send cleartext over the secure connection.) Thanks, Mario -----Original Message----- From: Michael T. Babcock [mailto:mbabcock@fibrespeed.net] Sent: Wednesday, October 04, 2000 1:45 PM To: John Guynn; Martin Neimeier; Php-Db (E-mail) Subject: Re: [PHP-DB] authorization idea (good or bad?) > At any rate, I've seen enough arguments against this idea to settle on > username and password only...and I am only going to compare the md5 hash of > the username and password, not cleartext. Don't forget that the password is still sent in cleartext across the Internet before your PHP program ever sees it to compare it with MD5. It may be stored on your server in hashed format, but its still cleartext on the Internet.