2
  1. Is my password sent unencrypted when using Phpmyadmin through http?
  2. If not, is there any downside using http compared to https?
  • 1
    Maybe you mixed up http and https in point 2? If available, i would always use https to administrate your webpage. – martinstoeckli Nov 21 '12 at 11:53
  • @martinstoeckli: I think point 2 is valid, but there is a confusing double negative... "If the password is not sent unencrypted over HTTP then what's the downside of using HTTP?". The fact that the password is sent unencrypted over HTTP answers point 2. – MrWhite Nov 21 '12 at 13:14
  • @w3d - Ahh yes, that sounds plausible. – martinstoeckli Nov 21 '12 at 13:17
  • @martinstoeckli - Yes. w3d was right. There's no need to answer 2. after the positive answer to 1. – jiv-e Nov 21 '12 at 23:33
3

If you are connecting to phpMyAdmin through HTTP then your password (and all your data) is being sent unencrypted.

However, if the form you are using to enter your username/password is sent to an HTTPS script (even though you might be on an unencrypted HTTP page) then it is sent encrypted, but then you would expect to remain on HTTPS for the duration of your session.

0

Username and password are sent as plain text during login. After this they are sent in encrypted format in cookies.

You can check this using LiveHTTP Headers plugin in Firefox for example.

  • I didn't have enough reputation to answer my own question earlier. But here it is! – jiv-e Nov 21 '12 at 23:30
  • I think it is more likely to be a session cookie you are seeing, rather than an "encrypted" username/password. – MrWhite Nov 22 '12 at 19:44
  • It might be, but why is there fields for username and password in the cookie? It doesn't seem necessary for a session cookie. These cookie field names could imply that username and password is sent encrypted during the session. pma_mcrypt_iv=... pmaUser-1=... pmaPass-1=... There's also a field phpMyAdmin=... which has Expires value Session. – jiv-e Dec 19 '12 at 5:52
  • Hhmm curious, I guess this may be dependent on the setup/phpMyAdmin version but I don't see pmaUser or pmaPass cookies being passed on my system. – MrWhite Dec 19 '12 at 12:05
  • Hmm... I don't have more time to investigate this. I'm still not sure what is the right answer though. – jiv-e Jan 23 '13 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.