How safe is it to send a plain text password using

Question

Maybe the title is badly phrased but couldn't think of a better way of saying it.

I am working on a login system at the moment (nothing formal, just experimenting) and was planning on using PHPLiveX (an AJAX library) for some features. Basically you create some PHP functions which are then called via JavaScript. You can add parameters (getElementById) to the JavaScript that are transfered to the PHP function.

What I really wanted to know is whether it is safe to just call the function from JavaScript without encrypting the password first, then letting the PHP function encrypt it (SHA256 in this case). Can the data transfered via AJAX be intercepted? If so how likely is this?

Answer 1

It isn't safe. Don't send unencrypted passwords. It's very likely that they will be intercepted at some point you will have a major problem.

Here is a video example of capturing a telnet password. Telnet sends in plain text and this nicely illustrates the major problem you have if you even think of doing this. Any two bit script kiddie can snag a plain text password faster than you can so "Oh my God, where did my database go?"

Answer 2

AJAX calls are just plain HTTP request.

It behaves like ordinary HTTP request and also comes with all the advantage and disadvantage of it. It is not any safer.

To make your AJAX calls safe, there are several ways you can try:

1. Use SSL. SSL will encrypt messages between your user and your server. The disadvantage of SSL is that you will have to pay additional fee for valid SSL certificates. Invalid SSL certificates while usable, does not provide the same level of guarantee of security to the users.
2. Encrypt requests before being sent, client-side. E.g.: hash users' password before being sent over the network. Most of the time, you don't need users' plain text password anyway. This is not usable when users don't allow client side scripting to run.
3. And apart from common misleading information where POST is safer than GET, it is not. Both are equally open for attackers to see.

Answer 3

No more-or-less safe than a normal HTTP POST request issued by a browser (as in from a <form>)

The "fix" for this is the same "fix" for non-AJAX requests - use SSL.

Answer 4

As already mentioned, SSL is the best solution here. However, you could hash the password on the client side. If you google for it, you'll find plenty of javascript implementations of md5.

Answer 5

Yes it can be read. Just like everything else without some kind of layer of security (See SSL)

To see it yourself run a tool like WireShark as you do your AJAX commands.

How likely? Not very, but the user's password will probably be saved in someone's log files in plain text. If someone eventually found it, then it could be bad news. Back in college, my networking class had access to some (semi) fancy routers. We had assignments where we signed up for accounts on random websites. As we did this, we noticed some very scary things on the log files in the routers. This was an eye opener for me to think about how every communication is tracked and most likely logged somewhere.

Answer 6

This is just as safe as having a login form that is not SSL secured be sent over the wire, like almost all forums out there do!