[Ikopar]

If sending a username and password through email when someone forgets their info is such a bad idea, then why do so many sites do it, and what better way is there?

[Roombor]

Why is it a bad idea?
Yeah
So does it when the users enters his password on your site
(unless you use https :)

[Ikopar]

Yeah, for that i'm hoping to use some kind of encryption

[Roombor]

Do you think it's necessary for your site to have that kind of security?

[Ikopar]

Probably not, but people i've talked to have kind of made me paranoid

[Roombor]

Haha :)
You can send out pgp encrypted mail ;)

[Ikopar]

Oh man, i don't know if my hosting thing supports that, i've never even heard of it

[Roombor]

Btw you dont have to send the password in the mail

[Ikopar]

What else would i do, create a link with a random key in it that gives them the password on my site?

[Roombor]

Yeah something like that
Theoretically they can sniff out that link ofcourse

[Ikopar]

Yeah, that would be a little harder to crack, but someone could...yeah, exactly

[Roombor]

Would they really go to such lengths to hack some account to your site

[Ikopar]

No, probably not
Submitting the password when logging in is probably a more pressing matter, no?
So that should be the first security measure i should take

[Roombor]

Your host probably supports https

[Ikopar]

Is that the same as SSL? i think they wanted me to pay an extra 150 a year or something ridiculous like that

[Roombor]

Oh :)
It's http with ssl encryption
Maybe they ask that much because they have validated ssl certificates or something
Validated = signed

[Ikopar]

Bah, i figure i could probably do the same thing myself right? with some javascript perhaps
Encode the password client side

[Roombor]

That wont really help
They could still sniff the hash and send that directly to your server

[Ikopar]

Damn it
Wait, what if there's a random key stored in a javascript variable
That dictates how it's encoded
And...oh, but it'd have to send the key too

[Roombor]

Yeah :)

[Ikopar]

No, the key could match on the server, it could be stored both places
It has to be send originally though, bah
Security is hard
Roombor: can i limit access to a page so that only other pages on my domain can access them? because that way they couldn't send the hash directly to the page, it's a JSP in this case

[Roombor]

maybe the random key thing will work
If you store the pass md5 encrypted server side + some random generated key
On the client side encrypt it once with the normal key, and encrypt the hash with the random key
Send it back to the server, on the server encrypt the hash with the random key, compare and generate a new random key
If they sniffed the hash it will be useless since the random key has changed

[Ikopar]

thanks, you've given me some good ideas

[Roombor]

;)