Re: LoginMD5.pm (Perl/CGI - Javascript User Authentication)

On Sat, 24 Aug 2002 21:12:32 -0700, [email protected] (Alan
Raetz) wrote:

>Hi,
>
>I created a module for Perl/CGI script user authentication that uses MD5 encryption 
>on both the client browser (using Javascript) and on the server (using Digest::MD5) and 
>I wanted to solicit comments and get any feedback from the group.
>
>http://perl-md5-login.sourceforge.net/
>
>http://sourceforge.net/projects/perl-md5-login/
>
>I'm definitely not a security expert, this was just something I needed for my own
>project that I decided to make open-source, it seemed like something other
>people could use... 
>
>The additional feature that I have working but haven't released is tying the cookie
>to the IP address; a user can move around, but each session is tied to the cookie hash.
>But I know this is just an environment variable that can also be hacked...
>
>One thing I'm wondering if is if this could possibly be a candidate for CPAN...
>
>comments?

Yeah, I like the idea of your module, it isn't as good as 
https but at least it tries to give plain http users some
protection.

However, I've found a glitch in your program.

I'm using a copy I downloaded in July version 1.1.

Anyways, I see the login password  when I watch
the transaction with ethereal. Below is a sample
ethereal dump, and it shows my password "ztest"
being sent. I  have debug mode = 0, so it isn't debug
sending it. Anyways, you need to make sure that
the password isn't being sent in the clear.

(Some wordwrapping occurred below)

..xËCont ent-Type
 applic ation/x-
 www-form -urlenco
 ded..Con tent-Len
 gth: 120 ....user
 =zentara &passwor
 d=405743 7cb49266
 a736a651 3e4ed80c
 bf&hash= ztest&se
 ssion=40 57437cb4
 9266a736 a6513e4e
 d80cbf&S ubmit=Su
 bmit