HTTPS on the ContractorUK

[fool]

The passwords are encrypted client side(md5) and the hashed password is sent to the server in plain text.

Okay, I looked at the form. That's true. What a weird practice.

The drip feeding of information to the point that people say enough that they become identifiable is nothing new. But that is actually a reason to do slightly more to protect users rather than less.

It is, however, irrelevant to the reason why ssl is being introduced - which is more about intermediate steps injecting information and adverts into the request

Hashes are used for validation but they don't always have to be the same. Bcrypt doesn't generate the same hash for the same input, but they can be validated against each other.

[woohoo]

Hashing a password is not encryption, encryption means you encrypt something that can later be decrypted, hashing is more a validation check, the string x (assuming a salt that is consistent) will always generate the same hash code y. This ensures that the database does not store the plain text password.

I know how md5 works, just sloppy use of the word encrypt.

[eek]

Okay, I looked at the form. That's true. What a weird practice.

That’s fairly standard nowadays (in both forum and Wordpress software) as it’s a means of ensuring the unhashed password isn’t sent unless absolutely necessary - downside is that the salt will be visible somewhere unless the hash is based on just username and password

[eek]

I know how md5 works, just sloppy use of the word encrypt.

When trying to win points don’t provide a means of atack.

I’m an equally opportunity attacker - I’m happy to attack anyone who seem (even accidentally) to know less than they claim to

[woohoo]

When trying to win points don’t provide a means of atack.

I’m an equally opportunity attacker - I’m happy to attack anyone who seem (even accidentally) to know less than they claim to

That's the wrong way to look at it. I'm happy if I learn something new and if someone was to give me a valid reason for not using SSL on this website, then I would say I'm wrong and be a bit wiser.

[fool]

That’s fairly standard nowadays (in both forum and Wordpress software) as it’s a means of ensuring the unhashed password isn’t sent unless absolutely necessary - downside is that the salt will be visible somewhere unless the hash is based on just username and password

I still think it's weird because it seems somewhat pointless.

It looks like a concatenation of itself 3 times, one of which is the hash, hashed with md5. The problem is once you know what it's doing, which you can figure out by reading the client side code, you can generate a rainbow table pretty quickly using md5.

Only those with increasingly long and/or estoric passwords would really have any level of protection. If it were PBKDF2, bcrypt, scrypt or something along those lines, I could see it adding value, but even then once single a hashed is leaked, we assume it's compromised. Hashing is only really buying you time until it's cracked and that time is supposed to be used to rotate.

Still, interesting to know people are doing this... Also, transport security isn't just about auth. I know you know this, the others evidently don't.

[woohoo]

Okay, I looked at the form. That's true. What a weird practice.

I agree it's a bit weird.

[fool]

That's the wrong way to look at it. I'm happy if I learn something new and if someone was to give me a valid reason for not using SSL on this website, then I would say I'm wrong and be a bit wiser.

Okay, so we don't want SSL. We want TLS, preferably 1.2. ;]

[woohoo]

Okay, so we don't want SSL. We want TLS, preferably 1.2. ;]

hah, yes.

[administrator]

Job done. Been on our minds to sort SSL out here for quite a while so thanks for the nudge Got a wildcard cert as making some changes to the front end of the site very soon and need to do www forum and ads sub domains. Fingers crossed will be able to redo the forum soon as well. One thing at a time though...