Re^6: encrypt/decrypt string

Replies are listed 'Best First'.
Re^7: encrypt/decrypt string by driver8 (Scribe) on Oct 19, 2006 at 22:50 UTC
Artist, what they are saying is: if you want the login info to be secure, why not just use a random string or number and link it to that login on the server side? If you don't really care about it being secure, why not just send the login unencrypted? Personally, I still can't see what you want to accomplish by encrypting. -driver8	[reply]
Re^8: encrypt/decrypt string by artist (Parson) on Oct 26, 2006 at 23:51 UTC
By encrypting the login, people cannot forge logins to hack the system. --Artist	[reply]
Re^9: encrypt/decrypt string by pKai (Priest) on Oct 27, 2006 at 06:25 UTC
`...?id=mylogin` attacker knows other users login or guesses it and can easily impersonate as that user. `...?id=myloginecrypted` attacker knows other users login and can deduce the encoding/encrpytion sceme (e.g. by deriving from his own login->loginencrypted; i.e. "plain text attack"). One more hurdle compared to (1), but not really that harder. `...?id=randomtokenmatchedbyservertouser` Here there is no encryption to guess. Attacker actually has to get hold of the token for the user he wants to impersonate (Which works for (2) too, of course) Seems you want to avoid (1) by choosing (2), which is not really an improvement IMHO. The alternative (3), proposed by others in this thread, is far "safer" with respect to your goal.	[reply] [d/l] [select]
Re^10: encrypt/decrypt string by artist (Parson) on Oct 27, 2006 at 14:38 UTC