RE: [WEB SECURITY] username & pw in clear-text through SSL considered safe?

["Martin O'Neal" <martin.oneal@xxxxxxxxxxxx>]

> There are definitely hashing schemes that add to 
> the security of a password in transit.

Your examples use a badly configured SSL implementation to justify
themselves though.  Adding additional cryptography (by hashing the
password) as some form of alternative to setting up your server properly
is flawed logic.  

Fix the problem, not the symptom (kick the ball, not the player).

Martin...

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives:
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS:
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA