Encrypted Login But Not Server-Based Authentication

[Five By Five]

I want user authentication to a MySQL system

1. The server will set up with the client to encrypt username/password
during transport, but the server does not authorize user at any level.

2. Username/password is in user table of MySQL, and MySQL will report
successful authentication.

Most of the schemes I've seen in the web seem to transport the password in
plaintext...isn't this an OBVIOUS security flaw?

How can I handle this?

PHP Interface version 5
Server: IIS 7.0 (running on VEEsta) but possibly Apache too

[larry]

On Aug 17, 9:31 am, Five By Five <[e-mail]:

I want user authentication to a MySQL system

1. The server will set up with the client to encrypt username/password
during transport, but the server does not authorize user at any level.

2. Username/password is in user table of MySQL, and MySQL will report
successful authentication.

Most of the schemes I've seen in the web seem to transport the password in
plaintext...isn't this an OBVIOUS security flaw?

How can I handle this?

PHP Interface version 5
Server: IIS 7.0 (running on VEEsta) but possibly Apache too

Two I can think of
Best/easiset method - use an SSL connection, that way all of your
communication is encrypted.

Do something with javascript on the client to encrypt the data before
sending, but then again you can't really trust most any client to
provide security even if the codse transmits OK who is to know if
there is no spyware app on the client listening in and reproducing the
encrypted data for someone else..

Then again

You might look into another separate form of validation like a
changing token value or something instead.

[djaekimaar]

Http Digest Authentication might be worth looking at

http://uk2.php.net/features.http-auth

[Five By Five]

la***@portcommodore.com wrote in comp.lang.php:

On Aug 17, 9:31 am, Five By Five <[e-mail]:

>I want user authentication to a MySQL system

1. The server will set up with the client to encrypt
username/password during transport, but the server does not authorize
user at any level.

2. Username/password is in user table of MySQL, and MySQL will report
successful authentication.

Most of the schemes I've seen in the web seem to transport the
password in plaintext...isn't this an OBVIOUS security flaw?

How can I handle this?

PHP Interface version 5
Server: IIS 7.0 (running on VEEsta) but possibly Apache too

Two I can think of
Best/easiset method - use an SSL connection, that way all of your
communication is encrypted.

I don't really even care if the entire session is encrypted, just the
login.

But I will look into enabling SSL on IIS.

>
Do something with javascript on the client to encrypt the data before
sending, but then again you can't really trust most any client to
provide security even if the codse transmits OK who is to know if
there is no spyware app on the client listening in and reproducing the
encrypted data for someone else..

I am assuming client security...if they let key loggers on their host or
are using a publicly used host, they assume the risks even in the face of
warnings.

>
Then again

You might look into another separate form of validation like a
changing token value or something instead.

[C. (http://symcbean.blogspot.com/)]

On 17 Aug, 17:31, Five By Five <[e-mail]:

I want user authentication to a MySQL system

1. The server will set up with the client to encrypt username/password
during transport, but the server does not authorize user at any level.

2. Username/password is in user table of MySQL, and MySQL will report
successful authentication.

Most of the schemes I've seen in the web seem to transport the password in
plaintext...isn't this an OBVIOUS security flaw?

How can I handle this?

PHP Interface version 5
Server: IIS 7.0 (running on VEEsta) but possibly Apache too

This is pretty much becoming a FAQ on this NG - try google for PHP
authentication password hash

(the best answer is to use SSL)

C.