IAmNolanPerry
commented
6 years ago Fixed by Pull Request #68 , It it forces a SSL Connection when logging in
Open Morketh opened 8 years ago
IAmNolanPerry
commented
6 years ago Fixed by Pull Request #68 , It it forces a SSL Connection when logging in
Morketh
commented
6 years ago Good news. Where is the web page expecting to find the SSL Certs/Keys? Or is this included in the sample-config.php file?
Login information is transported as plain-text between browser and MySQL server.
Browser ---> Server (PHP) ---> MySQL ===> Database Storage
(--) unencrypted
(==) encrypted
Information between the MySQL server and the Storage are encrypted with the sha512 hashes, However the browser is sending unencrypted passwords to the MySQL back-end for hashing. This is a major security flaw and needs to be addressed as soon as possible. Ideally a Java script on the browser needs to encrypt the password using the sha512 algorithm and then send the hash to the MySQL server for storage. That way every link in the chain is encrypted and no passwords are being leaked. PHP is SERVER ONLY and thus cannot reliably offer endpoint encryption so communication between the user's Terminal and the Server are still in plaintext. PHP can still be used to generate parts of the webpage dynamically based on session IDs and Login information but i would not suggest using PHP for transporting sensitive information from the user.
What is should look like:
Browser (Java) ===> MySQL ===> Database Storage.