Re: MD5 Password encoding (was: Defeating Citi-Bank Virtual Keyboard Protection)

[mike () sharecube com]

The purpose of MD5 password encoding has almost nothing to do with protection of the password field.

The entire password has to have been entered and stored somewhere before the MD5 encryption can be performed. That 
somewhere can be spied upon. 

MD5 password protection is used to insure that the submitted contents are NOT from a bot trying to play a logon attack. 
It is a sort of CAPTCHA protection since the logon must come from logon form on the implemented web site.

Mike
www.sharecube.com