Ext.ux.EncryptionLoginForm

[jmariani]

Are you sure your sha256 function behaves ok? Because it gives me very different values from sha256sum (a Linux command)

For the string "123"

Your function: a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3

echo 123 | sha256sum: 181210f8f9c779c26da1d9b2075bde0127302ee0e3fca38c9a83f5b1dd8e5d3b

Regards.

[ZeusTheTrueGod]

I see no reasons to send a hash of a password instead of the password itself. When your packets are intercepted the attacker will receive the hash instead of password. But that means the attacker will generate the same ajax request from him computer and send it to the server, because instead of comparing passwords your server compares hashes.

Just use https and don't simulate the security.

[dj]

Are you sure your sha256 function behaves ok? Because it gives me very different values from sha256sum (a Linux command)

For the string "123"

Your function: a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3

echo 123 | sha256sum: 181210f8f9c779c26da1d9b2075bde0127302ee0e3fca38c9a83f5b1dd8e5d3b

Regards.

You should use

echo -n 123 | sha256sum

echo adds a newline, so you did not generate the SHA256 sum of "123" but of "123\n".

I see no reasons to send a hash of a password instead of the password itself. When your packets are intercepted the attacker will receive the hash instead of password. But that means the attacker will generate the same ajax request from him computer and send it to the server, because instead of comparing passwords your server compares hashes.

Just use https and don't simulate the security.

Yes, it is a relative moderate security improvement to only send the hash of a password over the wire instead of the clear text password. The attacker doesn't know the password but nontheless can log into the account by just capturing the login request. But toss in some means to prevent replay attacks (like a timestamp and a nonce) and this solution becomes quite secure*. Even when you cannot switch your application over to SSL (e.g. because your hoster doesn't support it or you don't have the money for a certificate).

* = Only "quite secure" because sophisticated man-in-the-middle attacks are still possible.

[urmilsetia]

Hi guys,

How can this be implemented in sencha touch 2.1