1

Several searches only turned up questions about encrypting login info on the server side. Does Mediawiki encrypt logins after you type them in the browser and send them? (to prevent a man-in-the-middle from reading them in transit and taking over an account)

2 Answers 2

2

Nope, they're submitted as clear form data on the POST request. You definitely need SSL on your login page.

0

No serious web application encrypts logins on the server side. At most it would give you an illusion of safety, as opposed to the real safety provided by HTTPS. If the web traffic is unencrypted, the attacker can arbitrarily alter the data you send or receive (for example, inject malicious Javascript that logs the password as you type it; or wait until you log in and then copy your cookies and issue commands in your name).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.