[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[WEB SECURITY] username & pw in clear-text through SSL considered safe?

--_c060ef59-baeb-44ee-a001-9d8664115004_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi All,
=20
I recently came across a website that passed the user credentials through t=
he http header in clear-text but via https. =20
Is this practice considered secure? =20
Would this also show that the passwords are being stored in clear-text and =
not encrypted with a salt value in the db?
It seems to be there are a few more secure options when dealing with authen=
tication what do you all suggest as the best for a low user (less than 10) =
system?
The system does need added security due to the contents.
=20
Thanks=

--_c060ef59-baeb-44ee-a001-9d8664115004_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class=3D'hmmessage'>Hi All,<BR>
&nbsp;<BR>
I recently came across a website that passed the user credentials through t=
he http header in clear-text but via https.&nbsp; <BR>
Is this practice considered secure?&nbsp; <BR>
Would this also show that the passwords are being stored in clear-text and =
not encrypted with a salt value in the db?<BR>
It seems to be there are a few more secure options when dealing with authen=
tication what do you all suggest as the best for a low user (less than 10)&=
nbsp;system?<BR>
The system does need added security due to the contents.<BR>
&nbsp;<BR>
Thanks<BR></body>
</html>=

--_c060ef59-baeb-44ee-a001-9d8664115004_--
Brought to you by http://www.webappsec.org
Search this site