Safest way to send username + password? [AJAX]

johnwalker if you say so but, me I don't trust anything. If there is will there is way. I am sure there are someone whom is better at hacking. Nothing is safe

I love your paranoia, but SSL (and secure server-side programming) are your best bet for now.

Secure server-side programming protects against:

https://owasptop10.googlecode.com/files ... 202013.pdf

gumshoe2029 like I said one cannot trust one another therefore forget your SSL or whatever

This is what SSL is for, it will encrypt the details over the network.

This.

Oh please give break

Oh please give break

Perhaps give yourself a break if you haven't got the faintest idea what your commenting about.

SSL is https:// connections.

gumshoe2029 like I said one cannot trust one another therefore forget your SSL or whatever

Lord Shiva,

Yes SSL (or specifically https) can be hacked, absolutely! One common way is the 'man in the middle attack' you can find details on it here:

https://en.wikipedia.org/wiki/Man-in-the-middle_attack

The idea to encrypt is not to protect from everyone, like a bee with a sting, it will not protect itself from a fox. But it is sufficient to deter most attempts, so attackers go elsewhere.

Peace, John

lennaert Well you bumped a thread where I made comments about three years ago, and my stance has changed: as long as you have a decent SSL implementation, you should be OK - but you should still send password hashes and not actual passwords, so they're not even plaintext on the receiving endpoint. Anyways I don't consider myself a security expert so don't ask me.

Ashley ASHLEY SAID

lennaert Well you bumped a thread where I made comments about three years ago, and my stance has changed: as long as you have a decent SSL implementation, you should be OK - but you should still send password hashes and not actual passwords, so they're not even plaintext on the receiving endpoint. Anyways I don't consider myself a security expert so don't ask me.

Ashley ASHLEY SAID

If you had the slightest idea what the above meant... you likely would not have quoted.

Even ashley's stance on the hash for the endpoint is useless unless you consider your server as hacked/unsafe and I will point out his last comment as a good guide on the matter.

The end point is your server receiving the name and password. (Or your webhost)

Which performs the decryption of the SSL connection.

I give up you win but, if you get hacked you will know

I give up you win but, if you get hacked you will know

If someone hacks one of my servers they would still need to crack the encrypted stored passwords in my database ??

It is far more likely someone installs some stupid browser addon which records keystrokes and then sends it over to some 3rd party which basically abused the users lack of security knowledge for browsers on their end.

I actually know a little about this ??

Good for you at least you know that

> I give up you win but, if you get hacked you will know

>

If someone hacks one of my servers they would still need to crack the encrypted stored passwords in my database ??

It is far more likely someone installs some stupid browser addon which records keystrokes and then sends it over to some 3rd party which basically abused the users lack of security knowledge for browsers on their end.

I actually know a little about this ??

Yea, I worked in the military cybersecurity world for a while... at least until I publicly supported Edward Snowden.

I am in the process of getting encrypted database passwords done. And still developing a draw a secret password system too... so much to do, and so little time.

How do you encrypt the passwords for your database? I assume you are using symmetric encryption. Where do you store the keys?

This plugin, I guess, should do the trick.

Since there are two keys – private (on server) and public (in C2), it's harder (I think it's impossible, correct me if I'm wrong) for a hacker to decrypt it. Even if they know the public key, they can only encrypt data and send it to the server, but cannot decrypt it.

Also, it's a good idea to encrypt the public key a bit (instead of plain-pasting it to C2, maybe split it into lots of pieces, then use these pieces together to compose it, change numbers to equations etc.).

Nothing is Impossible there are people whom can do what no one has done it before and that is fact

This plugin, I guess, should do the trick.

Since there are two keys – private (on server) and public (in C2), it's harder (I think it's impossible, correct me if I'm wrong) for a hacker to decrypt it. Even if they know the public key, they can only encrypt data and send it to the server, but cannot decrypt it.

Also, it's a good idea to encrypt the public key a bit (instead of plain-pasting it to C2, maybe split it into lots of pieces, then use these pieces together to compose it, change numbers to equations etc.).

Nothing is impossible, sadly. Most encryption schemes can be cracked by super computers doing cryptanalysis given enough time. The idea behind a secure system is that the lifetime of the information being secured is shorter than the amount of time it takes to break into a secure system. However, more often, hackers use system vulnerabilities or social engineering to break into the system, like Heartbleed, ShellShock, or spear phishing. Our servers were attacked with ShellShock attacks even before it really became widely known, so I was patched before it was widely publicized simply because I was keeping an eye on our server logs.

As far as SSL is concerned, the easiest way to "crack" it is to execute a man-in-the-middle attack replacing the SSL certificate with another local one. This is detectable though and can be protected against with browser certificate trust settings. It should be noted though that SSL doesn't protect your server. It protects your user's passwords and usernames in transit between them and you.

But for our purposes(and yours too), SSL (public-private or asymmetric key cryptography) is as good as we need.

You shouldn't need to encrypt the public key. That one is public because it only allows people to encrypt data back to you, not decrypt anything. The private key can be encrypted on your server, but you need to be able to decrypt it readily, which ties back into my question about how to secure symmetric keys on your servers. I know a lot of sys admins use TrueCrypt to just encrypt the entire drive partition, but I am not sure if this works on virtual partitions or not.