[eluser]Rob Pomeroy[/eluser]
If I'm reading this right, the password is sent in the clear over the wire - is that right? A few years back I remember implementing an insanely paranoid login system using a javascript MD5 library to send a hashed, salted, hashed password to the web server. The salt was randomly generated by the server at the time the browser session began. This same salt was applied to the already-hashed password stored in the database, for comparision purposes. I can't quite remember the details.
Anyway, the point is I was wondering if Ben and the other folks working on this had an opinion on the plaintext password issue? Assuming that SSL is not desired/available, that is.
