3 ms·

Let's say that I'm implementing a login form via AJAX. After the "Submit button" click event, I fire up a jQuery ajax.get() to the auth script, and then store l

Let's say that I'm implementing a login form via AJAX. After the "Submit button" click event, I fire up a jQuery ajax.get() to the auth script, and then store logged-in status as a session cookie. This seems reasonably secure except for the fact that the password gets passed plaintext via the network. Is my best option to md5() it locally via JS, before I send it over? It's for a charity website so I don't think it'll be a big target, but I don't think that excuses bad security. Sorry if this is better for StackOverflow, it just seems appropriate here as I have gleaned some great coding tips via HN.

simonw 17y ago
MD5ing in JavaScript doesn't help, because the thing you're defending against is a man-in-the-middle attack. If someone can get in the middle and steal an unencrypted password, they can also get in the middle and re-write your HTML form to remove the client-side encryption code. To protect against man-in-the-middle you need SSL.
andymism 17y ago
Yes, this will work if you want to keep from sending the password in plain text. But you should make sure you send the request via POST rather than GET and know that you are still vulnerable to replay attacks--an attacker could just sniff out the username and hash, which they could present to you and still authenticate on your site (though they wouldn't know the actual password). Also, as far as md5 hashes go, rainbow table lookups work pretty well, so hashing alone won't provide great password security. Another way to solve your problem would be post to your auth script via SSL. From what I know of SSL (correct me if I'm wrong, please), the handshake and encrypted connection is established before any data is sent, which will protect you against sending passwords in the clear and against password sniffing.

3 ms·

Let's say that I'm implementing a login form via AJAX. After the "Submit button" click event, I fire up a jQuery ajax.get() to the auth script, and then store l

by zackattack 17y ago

simonw 17y ago
MD5ing in JavaScript doesn't help, because the thing you're defending against is a man-in-the-middle attack. If someone can get in the middle and steal an unencrypted password, they can also get in the middle and re-write your HTML form to remove the client-side encryption code. To protect against man-in-the-middle you need SSL.
andymism 17y ago
Yes, this will work if you want to keep from sending the password in plain text. But you should make sure you send the request via POST rather than GET and know that you are still vulnerable to replay attacks--an attacker could just sniff out the username and hash, which they could present to you and still authenticate on your site (though they wouldn't know the actual password). Also, as far as md5 hashes go, rainbow table lookups work pretty well, so hashing alone won't provide great password security. Another way to solve your problem would be post to your auth script via SSL. From what I know of SSL (correct me if I'm wrong, please), the handshake and encrypted connection is established before any data is sent, which will protect you against sending passwords in the clear and against password sniffing.