By using this site, you agree to our updated Privacy Policy and our Terms of Use. Manage your Cookies Settings.
438,348 Members | 1,397 Online
Bytes IT Community
+ Ask a Question
Need help? Post your question and get tips & solutions from a community of 438,348 IT Pros & Developers. It's quick & easy.

Encrypted Login But Not Server-Based Authentication

P: n/a

I want user authentication to a MySQL system

1. The server will set up with the client to encrypt username/password
during transport, but the server does not authorize user at any level.

2. Username/password is in user table of MySQL, and MySQL will report
successful authentication.

Most of the schemes I've seen in the web seem to transport the password in
plaintext...isn't this an OBVIOUS security flaw?

How can I handle this?

PHP Interface version 5
Server: IIS 7.0 (running on VEEsta) but possibly Apache too
Aug 17 '08 #1
Share this Question
Share on Google+
4 Replies


P: n/a
On Aug 17, 9:31 am, Five By Five <5...@5x5.comwrote:
I want user authentication to a MySQL system

1. The server will set up with the client to encrypt username/password
during transport, but the server does not authorize user at any level.

2. Username/password is in user table of MySQL, and MySQL will report
successful authentication.

Most of the schemes I've seen in the web seem to transport the password in
plaintext...isn't this an OBVIOUS security flaw?

How can I handle this?

PHP Interface version 5
Server: IIS 7.0 (running on VEEsta) but possibly Apache too
Two I can think of
Best/easiset method - use an SSL connection, that way all of your
communication is encrypted.

Do something with javascript on the client to encrypt the data before
sending, but then again you can't really trust most any client to
provide security even if the codse transmits OK who is to know if
there is no spyware app on the client listening in and reproducing the
encrypted data for someone else..

Then again

You might look into another separate form of validation like a
changing token value or something instead.

Aug 17 '08 #2

P: n/a
Http Digest Authentication might be worth looking at

http://uk2.php.net/features.http-auth
Aug 17 '08 #3

P: n/a
la***@portcommodore.com wrote in comp.lang.php:
On Aug 17, 9:31 am, Five By Five <5...@5x5.comwrote:
>I want user authentication to a MySQL system

1. The server will set up with the client to encrypt
username/password during transport, but the server does not authorize
user at any level.

2. Username/password is in user table of MySQL, and MySQL will report
successful authentication.

Most of the schemes I've seen in the web seem to transport the
password in plaintext...isn't this an OBVIOUS security flaw?

How can I handle this?

PHP Interface version 5
Server: IIS 7.0 (running on VEEsta) but possibly Apache too

Two I can think of
Best/easiset method - use an SSL connection, that way all of your
communication is encrypted.
I don't really even care if the entire session is encrypted, just the
login.

But I will look into enabling SSL on IIS.
>
Do something with javascript on the client to encrypt the data before
sending, but then again you can't really trust most any client to
provide security even if the codse transmits OK who is to know if
there is no spyware app on the client listening in and reproducing the
encrypted data for someone else..
I am assuming client security...if they let key loggers on their host or
are using a publicly used host, they assume the risks even in the face of
warnings.
>
Then again

You might look into another separate form of validation like a
changing token value or something instead.



Aug 17 '08 #4

P: n/a
On 17 Aug, 17:31, Five By Five <5...@5x5.comwrote:
I want user authentication to a MySQL system

1. The server will set up with the client to encrypt username/password
during transport, but the server does not authorize user at any level.

2. Username/password is in user table of MySQL, and MySQL will report
successful authentication.

Most of the schemes I've seen in the web seem to transport the password in
plaintext...isn't this an OBVIOUS security flaw?

How can I handle this?

PHP Interface version 5
Server: IIS 7.0 (running on VEEsta) but possibly Apache too
This is pretty much becoming a FAQ on this NG - try google for PHP
authentication password hash

(the best answer is to use SSL)

C.
Aug 19 '08 #5

This discussion thread is closed

Replies have been disabled for this discussion.