Is it safe to send password via post?

Is it safe to send password via post?

Quick Answer: It is a standard practice to send “plain text” passwords over HTTPS via POST method. As we all know the communication between client-server is encrypted as per TLS, so HTTPS secures the password. The sensitive informations e.g. password, creditcard are never intended to be logged.

Are passwords sent encrypted?

Passwords are encrypted by the AES128 algorithm before they are stored in the directory and are retrieved as part of an entry in the original clear format. Passwords are encrypted by the AES192 algorithm before they are stored in the directory and are retrieved as part of an entry in the original clear format.

Should passwords be encrypted on the client side?

But simply hashing the password on the client side is only just better than submitting it as plain text to the server. Someone, who can listen for your plain text passwords is certainly also able to listen for hashed passwords, and use these captured hashes him/herself to authenticate against your server.

Is it OK to send plaintext password over HTTPS?

3 Answers. It is standard practice to send “plaintext” passwords over HTTPS. The passwords are ultimately not plaintext, since the client-server communication is encrypted as per TLS.

What is the best way to send passwords?

How to send passwords safely

1. Communicate passwords verbally, either in person or over the phone.
2. Communicate passwords through encrypted emails. Sending passwords via unencrypted emails is never recommended.
3. Send passwords in a password vault file such as KeePass.

Is hashing done client-side?

A pretty uncommon, but really good practice, is the client-side hashing. It is supposed act as another layer of security, hiding the password from the server. The idea is that the client-side should hash (e.g. scrypt ) the password before sending it to the server.

Is it safe to send a password over HTTPS?

The OP never mentioned sending the password in clear over HTTP – only HTTPS, yet many seem to be responding to the question of sending a password over HTTP for some reason. That said: I believe passwords should never be retained (let alone transmitted) in plain text. That means not kept on disk, or even in memory.

Is it safe to send passwords in plain text?

It is safe. That’s how the entire web works. All passwords in forms are always sent in plain text, so its up to HTTPS to secure it. You still need to make sure you send it via POST request, not GET. If you send it via GET request, it could be saved in plaintext in the user’s browser history logs or the webserver’s access logs.

Is it safe to transmit password in the clear?

You should never transmit a key or password “in the clear”. Not even over HTTPS. HTTPS is not impenetrable. In fact, many organisations can become a trusted MITM – not from an attack perspective, but to perform inspections on the traffic to implement their own security policies.

What’s the best way to secure a password?

Use HTTP Digest – it secures the password even over http (but best useage would be http digest over https) HTTP digest access authentication is one of the agreed methods a web server can use to negotiate credentials with a web user (using the HTTP protocol).