Re: MD5 Password encoding (was: Defeating Citi-Bank Virtual Keyboard Protection)

[Thomas Chiverton <thomas.chiverton () bluefinger com>]

On Wednesday 17 August 2005 05:52, Noam Eppel wrote:
> If you are implementing a one-way hash correctly, there should be no need
> to store the plaintext passwords. All that should be stored is the
> resulting hash of each password.

Yes, but in order to hash the password, the web page must ask the user for it, 
which means it is still vulnerable to sniffing.

-- 

Tom Chiverton 
Advanced ColdFusion Programmer