2000 character limit, so here's the rest: My first thoughts are on SSL - if that's secure enough. Because usernames and passwords hit the backend code in plain

2000 character limit, so here's the rest: My first thoughts are on SSL - if that's secure enough. Because usernames and passwords hit the backend code in plaintext, and then are transformed, a MITM attack that knows my ssl key could render it useless. Another thought is that if someone knows another's user/pass, they get access to everything - but that's kind of unavoidable. The whole goal is to never save anything as plaintext either. So that's why the username is SHA256'd, and the password is Bcrypted, and the data is AES256'd.