Another form of encrytion? "Not SSL" -- asp.net security

Psst! Did you know DevelopmentNow is a mobile web site design agency?

Contact us for help mobilizing your site, or to sign up for our beta Mobile Web SDK!

asp.net security : Another form of encrytion? "Not SSL"

Leon
10/30/2004 11:42:07 AM

How can I encrypted data sent across my website from web forms without using
SSL?
Such as on Login the user enter "EmailAddress" & "Password" and Simply
Registration Form
in which the user creates a Password, FirstName, LastName, etc.
I see site like Careerbuilder and Monster allow user to register, login, and
retrieve a lost password
without using a SSL connection "I Know anytime you deal with credit card
info you need a SSL.
Thanks!

Robert Hurlbut
10/30/2004 7:09:24 PM

Leon,

If there is no SSL being done on the form, then your information is more
than likely sent clear text. Now, they could be using SSL with a form post,
which would be secure, and you can tell this through "view source" on the
page. Even with SSL, though, just because the lock is there in the corner
doesn't always mean it is valid. You still have to check it.

Also, if you are able to get your password back from any site without them
re-generating a temporary password, then that site is probably storing your
password in clear text, or at best encrypting it with some key they use to
decrypt it. Ideally, you want the site to use a salt and one-way strong hash
to store your password, which means you can't ever retrieve the same
password.

Robert Hurlbut
http://weblogs.asp.net/rhurlbut
http://www.securedevelop.net

[quoted text, click to view]

Daniel Fisher\(lennybacon\)
10/30/2004 8:45:55 PM

You can use a javascript BigInt to encrypt dat before it's send and decrypt
it using BitInt in C# when it's submited.

--
Daniel Fisher(lennybacon)
MCP C# ASP.NET
Blog: http://www.lennybacon.com/

[quoted text, click to view]

Joerg Jooss
10/30/2004 11:00:04 PM

[quoted text, click to view]

So what makes you even think these sites are secure?

--
Joerg Jooss
www.joergjooss.de
news@joergjooss.de

Leon
10/31/2004 11:06:43 AM

So is it easy for a hacker to get personal information sent in clear text
across the web.

[quoted text, click to view]

Leon
10/31/2004 5:38:29 PM

but the network itself provide somewhat type of security during the process
of the clear text information passing across the web?

[quoted text, click to view]

Robert Hurlbut
10/31/2004 9:08:22 PM

Anything sent over a network without SSL or some other form of encryption is
in "clear text" form and can be viewed through a standard network sniffer.

Robert Hurlbut
http://weblogs.asp.net/rhurlbut
http://www.securedevelop.net

[quoted text, click to view]

Leon
10/31/2004 9:17:57 PM