Re: [pear-webmaster] Re: [PEAR-CVS] cvs: pearweb /include pear-auth.php /public_html login.php /public_html/javascript md5.js

On Sat Oct 01, 2005 at 07:2801AM -0400, Daniel Convissor wrote: > On Sat, Oct 01, 2005 at 10:16:01AM -0000, Martin Jansen wrote: > > > > Modified files: > > /pearweb/include pear-auth.php > > /pearweb/public_html login.php > > Log: > > * When logging in, the password is replaced by its MD5 hash before > > submitting the form. > > > > # This is not really as secure as SSL, and this is by no means a > > # full-fledged CHAP login system, but at least it gives a bit more security > > # than the current implementation. > > Not at all. Now crackers can sniff the md5 sum and send that instead of > sniffing the password and sending that. The only thing that's changed is > now we need to use JavaScript to use the PEAR website. Please revert. On an additional note, JavaScript is not needed at all: If ones browser does not support JavaScript, or if it is disabled for security purposes, the login system will fall back to sending the password in cleartext just like it was before. - Martin