note 20873 deleted from function.md5 by jimw
| From: | jimw@php.net | Date: | Sat, 08 Feb 2003 19:48:16 +0000 |
| Subject: | note 20873 deleted from function.md5 by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-43631@lists.php.net to get a copy of this message | ||
About MD5'ing a password and sending it to the server: An easy way to prevent a hacker from
sniffing the password from the line and playing it back (a replay attack) is including some extra
information before sending it, which is different all the time.
Here is an example:
When generating the login page, create a unique id string, there are some examples on this page how
to do so. In the javascript code on the client side, append the unique id string to the password the
user entered. Now you have a unique password string. MD5 this password string and submit the page.
On the server side, append the same unique id string to the original password and MD5 it too. If the
results are the same the password was entered correctly. Because the unique id string is different
all the time a replay attack is not possible.