Encrypted Login But Not Server-Based Authentication

I want user authentication to a MySQL system

1. The server will set up with the client to encrypt username/password
during transport, but the server does not authorize user at any level.

2. Username/password is in user table of MySQL, and MySQL will report
successful authentication.

Most of the schemes I've seen in the web seem to transport the password in
plaintext...isn't this an OBVIOUS security flaw?

How can I handle this?

PHP Interface version 5
Server: IIS 7.0 (running on VEEsta) but possibly Apache too

re: Encrypted Login But Not Server-Based Authentication

On Aug 17, 9:31 am, Five By Five <5...@5x5.comwrote:Two I can think of
Best/easiset method - use an SSL connection, that way all of your
communication is encrypted.

Do something with javascript on the client to encrypt the data before
sending, but then again you can't really trust most any client to
provide security even if the codse transmits OK who is to know if
there is no spyware app on the client listening in and reproducing the
encrypted data for someone else..

Then again

You might look into another separate form of validation like a
changing token value or something instead.

re: Encrypted Login But Not Server-Based Authentication

Http Digest Authentication might be worth looking at

http://uk2.php.net/features.http-auth

re: Encrypted Login But Not Server-Based Authentication

larry@portcommodore.com wrote in comp.lang.php:
I don't really even care if the entire session is encrypted, just the
login.

But I will look into enabling SSL on IIS.
I am assuming client security...if they let key loggers on their host or
are using a publicly used host, they assume the risks even in the face of
warnings.

re: Encrypted Login But Not Server-Based Authentication

On 17 Aug, 17:31, Five By Five <5...@5x5.comwrote:This is pretty much becoming a FAQ on this NG - try google for PHP
authentication password hash

(the best answer is to use SSL)

C.