Re: Re: WAYS OF AUTHENICATION - open discussion

> [My original post omitted.] > > I'd say this method is severely flawed, if I understand > > correctly. Indeed the password is not sent in plain text, but if > > I can listen to the session then the md5 hash and the timestamp > > is all I need. What prevents me from fabricating my own form and > > reuse in it both the md5 hash and the timestamp ? > > > > Manuel Garcia > > Okay, one thing I forgot to mention is that there is a time limit of one > minute on how long the user can take to log in. If there was no such time > limit, you would be correct. With this time limit, if someone can listen in > and get the hash in that time span, yes, you can. > > So, when the user logs in, the first thing I check is whether one minute has > expired since the timestamp occurred. If so, the user has to try again. If > not, I allow the login. > > Anything else? I've recently been working on almost the exact same authentication method. The only difference is that when the login page is requested, instead of a timestamp, I create a session variable called $token, and populate it with a unique id string, generated like this (thanks, in part, to others on this list): mt_srand((double)microtime()*1000000); $token = uniqid (mt_rand()) . $HTTP_SERVER_VARS["REMOTE_ADDR"]; I also write the value of the token into a javascript function as a literal string. Upon submission, the javascript function calculates md5(token + md5(password)) and populates a hidden input variable called auth_token. The server side then pulls the md5 hash from the database ($hashpwd) based on the login name, and calculates $verify_auth = md5($token . $hashpwd). If $verify_auth == $auth_token, the login is successful. As Dean's did, this scheme ensures that: 1. the user's password is not sent in plaintext. 2. the password hash that is sent is unique every time the user logs in It also ensures that there is very little chance anyone could create a valid the password hash since each new session will generate a new random token. I would be very interested and grateful if anyone can help me poke holes in this method. Joe