Re: [pear-webmaster] Re: [PEAR-CVS] cvs: pearweb /include pear-auth.php /public_html login.php /public_html/javascript md5.js

On Sat Oct 01, 2005 at 07:2801AM -0400, Daniel Convissor wrote: > Hi Martin: > > On Sat, Oct 01, 2005 at 10:16:01AM -0000, Martin Jansen wrote: > > > > Modified files: > > /pearweb/include pear-auth.php > > /pearweb/public_html login.php > > Log: > > * When logging in, the password is replaced by its MD5 hash before > > submitting the form. > > > > # This is not really as secure as SSL, and this is by no means a > > # full-fledged CHAP login system, but at least it gives a bit more security > > # than the current implementation. > > Not at all. Now crackers can sniff the md5 sum and send that instead of > sniffing the password and sending that. The only thing that's changed is > now we need to use JavaScript to use the PEAR website. Please revert. I know this, but on the positive side the password is not transmitted in cleartext, so people sniffing traffic between users and pear.php.net will not see the password, but only the hash. This way people using the same password on multiple sites will not run into the problem that their cleartext password is exposed to cracker, which would lead to access on more sites than just pear.php.net. And finally, the MD5 stuff is only a preparation for a CHAP login system, which I'll implement as soon as half a dozen people with old accounts have updated their passwords to MD5 instead of DES. (I've already contacted these people.) - Martin