Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 2 down vote favorite
  1. Is my password sent unencrypted when using Phpmyadmin through http?
  2. If not, is there any downside using http compared to https?
share|improve this question
1  
Maybe you mixed up http and https in point 2? If available, i would always use https to administrate your webpage. – martinstoeckli Nov 21 '12 at 11:53
@martinstoeckli: I think point 2 is valid, but there is a confusing double negative... "If the password is not sent unencrypted over HTTP then what's the downside of using HTTP?". The fact that the password is sent unencrypted over HTTP answers point 2. – w3d Nov 21 '12 at 13:14
@w3d - Ahh yes, that sounds plausible. – martinstoeckli Nov 21 '12 at 13:17
@martinstoeckli - Yes. w3d was right. There's no need to answer 2. after the positive answer to 1. – jiv-e Nov 21 '12 at 23:33

2 Answers

up vote 3 down vote

If you are connecting to phpMyAdmin through HTTP then your password (and all your data) is being sent unencrypted.

However, if the form you are using to enter your username/password is sent to an HTTPS script (even though you might be on an unencrypted HTTP page) then it is sent encrypted, but then you would expect to remain on HTTPS for the duration of your session.

share|improve this answer
up vote 0 down vote

Username and password are sent as plain text during login. After this they are sent in encrypted format in cookies.

You can check this using LiveHTTP Headers plugin in Firefox for example.

share|improve this answer
I didn't have enough reputation to answer my own question earlier. But here it is! – jiv-e Nov 21 '12 at 23:30
I think it is more likely to be a session cookie you are seeing, rather than an "encrypted" username/password. – w3d Nov 22 '12 at 19:44
It might be, but why is there fields for username and password in the cookie? It doesn't seem necessary for a session cookie. These cookie field names could imply that username and password is sent encrypted during the session. pma_mcrypt_iv=... pmaUser-1=... pmaPass-1=... There's also a field phpMyAdmin=... which has Expires value Session. – jiv-e Dec 19 '12 at 5:52
Hhmm curious, I guess this may be dependent on the setup/phpMyAdmin version but I don't see pmaUser or pmaPass cookies being passed on my system. – w3d Dec 19 '12 at 12:05
Hmm... I don't have more time to investigate this. I'm still not sure what is the right answer though. – jiv-e Jan 23 at 13:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.