Login security concept?

[Peter.Greulich]

If you create a login component with a function such as MD5(), how does that work?

If the password is encrypted w. MD5 before being sent across the web, how does the browser know what A5's MD5 function does? Does the browser somehow retrieve the function to the local browser and then encrypt it on the local client before sending it to the server?

I'm just trying to understand how this works conceptually.

[Pat Bremkamp]

Re: Login security concept?

Steve can probably explain the use of MD5.

I have used a different encryption using encrypt_string() and decrypt_string(). These functions use an encryption key which you can let your admin user set or change. The other advantage of encryption is that the password becomes case sensitive.

Pat

[Peter.Greulich]

Re: Login security concept?

Pat,

My question is not how the function works, but rather the conceptual functioning of the web/browser. If MD5 (or any other Alpha function) exists on the WAS SERVER, how is the password encrypted before transmitting across the web? If th password is not encrypted before being submitted, what would be the point of encryption? I want to understand the concept of how the data is securely transmitted. Not the mechanics of the function.

[acidcigarfiend]

Re: Login security concept?

Peter,

Great question. I actually didnt know the answer to this one, and your idea definately makes sense. To test it, I just performed a Man-in-the-Middle attack on myself. My login model online uses MD5() as its security, and all I was able to intercept was the MD5 hashed data, not the unencrypted data.

I have no clue as to how it works, but I can tell you that a simple intercept will not get the unencrypted data.

If you are actually worried about security, MD5() is probably not the way to go as it takes about 30 seconds to unhash most passwords encrypted that way, and anyone who knows how/cares enough to get the hash will know how to unhash it.

Hope this helps,
Chris

[Peter.Greulich]

Re: Login security concept?

Chris,

Thanks for your reply. I'm not hung up on MD5, and I know it can be reversed. I just want to understand the operating principal.

[Steve Wood]

Re: Login security concept?

Peter, I read through the comments here, and not sure of your question. Here is how it works in answer to what I think your question is.

Server side - Your Username table has a field that contains the 32-character hash value. The actual text password is NOT anywhere on the server, only that hash value. This means you have to have a script that lets the user enter a real password, and you write the hash value and discard the real password. If someone calls you and asks what their password is, you actually do not have any way of knowing.

Remote client (browser) side - On the Login page, the user types in the real password. An xbasic script turns that real password in to the hash value. Then you use lookup() to see if that hash value matches the value in the Username table.

Chris - I did not know you could crack the hash value so easily. Can we do a test, what does this one read:

"e99f5455061b598087e728a866bbafa0".

[Peter.Greulich]

Re: Login security concept?

Peter, I read through the comments here, and not sure of your question.
...
Remote client (browser) side - On the Login page, the user types in the real password. An xbasic script turns that real password in to the hash value.

Steve,

My question is: how does the browser know xbasic? Since the password is converted into the hash before being transmitted across the web, how does it convert the user typed password into the hash? I understand that the server side knows xbaisc, after all, that's where the WAS resides. I'm just trying to understand how the client side converts the value. Your local browser doesn't know xbasic.

[Steve Wood]

Re: Login security concept?

Well, er, I don't know either! There are a couple pages in the Alpha Help that speak around that topic, but don't really say. You know the request has to be making one and only one trip to and from the WAS, and Chris confirmed only the hash is sent, so it MUST be processing MD5() in the browser. But then again, how could it??

[Peter.Greulich]

Re: Login security concept?

But then again, how could it??

Exactly! Now you understand the question. Weird science or what?

I just want to understand the basic concept, which will help me figure this web thing out.

P.S. Maybe there are really two trips to the browser? The first one...?????

[Hansolo]

Re: Login security concept?

I think as long as you are implementing SSL and the client is using a relatively modern browser that supports SSL you don’t need to worry about plain text passwords in the clear.

As I am sure you know, Web site session encryption uses the Secure Socket Layer (SSL) to encrypt all of the information between the Web server and Web browser. As information such as your password is entered into a Web form, the BROWSER encrypts this information (the whole page!) before sending it to the server where it is decrypted. Likewise, when the server returns information to your browser, this information is first encrypted on the server and decrypted on the browser (the whole page!). By using session encryption via SSL, all of your information, not just your password, is safe as it transits the network path between your browser and the server.

If you are not using SSL then you have to come up with the encryption and keys (third party tools or you could still use SSL to supply the keys) and would have to use some scripting embedded in the page that initially gets sent to the browser from the server. When the password is filled in and the page submitted, the script would then encrypt the password and create the key before sending the information to the server. The server would then use a corresponding key to decrypt the password.

I am sure no web browsers currently support Xbasic functions intrinsically. Therefore, the use of this function on the client side is a farce unless some scripting that the browser understands (eg. JavaScript) is embedded in the published form of the a5w page when the MD5() function is included.

But I could be wrong :-)

[Peter.Greulich]

Re: Login security concept?

When the password is filled in and the page submitted, the script would then encrypt the password and create the key before sending the information to the server.

Thanks Hansolo. The SSL concept is clear to me, because that technology is built into the browser. But the latter explanation still does not compute (for me, at least). If MD5() is embedded in the page (to use an example), how does that functionality work on the client side, before sending to the server? Something is missing here. I know that it works properly, just don't understand how.

[Hansolo]

Re: Login security concept?

The page has to be requested from the server initially.

Does MD5() instruct the server to embed some JavaScript prior to sending the page to the browser?

I have no experiance with MD5() but it stands to reasion that the WAS is creating the page in accordance with the service needed and that the key to this is in how it treats MD5() before the page gets to the client.

[Hansolo]

Re: Login security concept?

Well, er, I don't know either! There are a couple pages in the Alpha Help that speak around that topic, but don't really say. You know the request has to be making one and only one trip to and from the WAS, and Chris confirmed only the hash is sent, so it MUST be processing MD5() in the browser. But then again, how could it??

There is actually an initial request for the page. You are only thinking about the Submitted request after fillin in the password. I think it is processing MD5() when the page is initially requested. Does that make sense?

[Peter.Greulich]

Re: Login security concept?

MD5() is irrelevant. The point is, how does the client side interpret xbasic. The server side does because that's where the WAS lives. And sure, an ordinary page gets sent to the server, where the WAS parses the xbasic and sends it back to the client. But if you are encrypting something with xbasic, how does the client do that without sending the unencrypted data along with the page/xbasic?

[Peter.Greulich]

Re: Login security concept?

The browser doesn't know what MD5() is.
It can't send the unencrypted password.
So MD5() (or any similar function) has to be processed first. - How?