As olus said, you can get around passing the plaintext password in the filesystem entirely if, instead of producing HTML code that invokes a separate CGI, you have your main CGI program generate the image (into the filesystem) and then produce HTML that points to this temporary file. You're still passing the password around in the filesystem, but using a generated image as a form of encryption.

Once you have done that, the next question is how to store the password for future comparison against the credentials supplied by the user.

The Unix password authentication system, which has worked well for many years, actually never stores the password itself, either in plaintext or in a format that can be decrypted. What it stores is a "hash", which is produced by encrypting a fixed plaintext, unrelated to the password, using the password as key. The key is then discarded, so the hash can never be decrypted. However, if the same plaintext is ever encrypted using the same algorithm using the same key, the hash produced is guaranteed identical. So you end up storing and comparing hashes of passwords instead of actual passwords.

Look at the crypt() function if you're on a Unix or Unix-like system, which works pretty much as I've just described (I've left out some details for simplicity); or look at MD5 digests, which operate similarly and are used in place of crypt() on some Linux distributions.

One last thing: you will run afoul of accessibility requirements -- which have the force of law in many applications -- using only an image to transmit temporary passwords like this. Visually impaired users will have to be provided their passwords in some other way, probably involving the telephone.

In reply to Re: Passing variable from one cgi to another by bigmacbear
in thread Passing variable from one cgi to another by 3SRT

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.