Random Technical Question

[herogee]

Was just wondering, when somebody is about to log in to MS and types in the username and password, is the password encrypted when it is sent over the net?

[picklemonkey]

no. The password box is a simple text box that is POSTed to the server in plain text

[Kamal]

Pickles not entirely right, we're not using an https folder but the passwords are converted into funky characters by the php when you hit the submit button.... while the information itself is not encrypted, its changed when it travels over the internet and so its not in plain text... once it reaches the db, its stored there in the same format and so even as an admin, I cannot read your password in the database because it is changed

hope that helps

-e-

[TomTom]

But we can change it to suckmyballsyoudirtymofo or whatever.

[herogee]

[...] so even as an admin, I cannot read your password in the database

Right, thanks for the answer. The point of my question was to find out whether someone using a packet sniffer could pick up the passwords, not whether the admins can read them ...

Just curious about password security ... I ask myself the same thing everytime I log in to yahoo.

[picklemonkey]

Pickles not entirely right, we're not using an https folder but the passwords are converted into funky characters by the php when you hit the submit button.... while the information itself is not encrypted, its changed when it travels over the internet and so its not in plain text... once it reaches the db, its stored there in the same format and so even as an admin, I cannot read your password in the database because it is changed

hope that helps

-e-

You're wrong. I looked at the source code and it submits the plain text user/pass to the login.php, which might encrypt it... but it's still submitted over the network in plain text. I just verified this with a packet sniffer.

It's sent in plain text.

[Kamal]

they can pick it up but it would take a good bit of phpbb decoding to see how the passwords are restructured.....as I said, while the packet itself if not encrypted during its journey over the net, password itself is changed so no one truly knows what your password is

-e-

[skahound]

I sniff girls' panties.

[picklemonkey]

[...] so even as an admin, I cannot read your password in the database

Right, thanks for the answer. The point of my question was to find out whether someone using a packet sniffer could pick up the passwords, not whether the admins can read them ...

Just curious about password security ... I ask myself the same thing everytime I log in to yahoo.

According to -e-, Admins can't read them.

Anybody else can if they're using a packet sniffer. I just verified this.

[PsynceFiction[MS]]

-Psynce-

[Kamal]

Anybody else can if they're using a packet sniffer. I just verified this.

how'd you verify this again ?

[Kamal]

no wait let me guess, you put a packet sniffer on your local machine and had it pick up the passwords ?

[picklemonkey]

I work in IT. I already have a packet sniffer installed.

[Civic_Zen]

You da man picklez

[Kamal]

damn, u PWNED Me on that one....

I find it hard to believe that its printing out the passwords directly on an http transfer, I know I read it somewhere on their forums that passwords are changed and transmitted over the net.....

guess that answers your Q herogee....

-e-