- Is my password sent unencrypted when using Phpmyadmin through http?
- If not, is there any downside using http compared to https?
-
1Maybe you mixed up http and https in point 2? If available, i would always use https to administrate your webpage.– martinstoeckliCommented Nov 21, 2012 at 11:53
-
@martinstoeckli: I think point 2 is valid, but there is a confusing double negative... "If the password is not sent unencrypted over HTTP then what's the downside of using HTTP?". The fact that the password is sent unencrypted over HTTP answers point 2.– MrWhiteCommented Nov 21, 2012 at 13:14
-
@w3d - Ahh yes, that sounds plausible.– martinstoeckliCommented Nov 21, 2012 at 13:17
-
@martinstoeckli - Yes. w3d was right. There's no need to answer 2. after the positive answer to 1.– jiv-eCommented Nov 21, 2012 at 23:33
Add a comment
|
2 Answers
If you are connecting to phpMyAdmin through HTTP then your password (and all your data) is being sent unencrypted.
However, if the form you are using to enter your username/password is sent to an HTTPS script (even though you might be on an unencrypted HTTP page) then it is sent encrypted, but then you would expect to remain on HTTPS for the duration of your session.
Username and password are sent as plain text during login. After this they are sent in encrypted format in cookies.
You can check this using LiveHTTP Headers plugin in Firefox for example.
-
I didn't have enough reputation to answer my own question earlier. But here it is!– jiv-eCommented Nov 21, 2012 at 23:30
-
I think it is more likely to be a session cookie you are seeing, rather than an "encrypted" username/password.– MrWhiteCommented Nov 22, 2012 at 19:44
-
It might be, but why is there fields for username and password in the cookie? It doesn't seem necessary for a session cookie. These cookie field names could imply that username and password is sent encrypted during the session.
pma_mcrypt_iv=... pmaUser-1=... pmaPass-1=...There's also a fieldphpMyAdmin=...which has Expires valueSession.– jiv-eCommented Dec 19, 2012 at 5:52 -
Hhmm curious, I guess this may be dependent on the setup/phpMyAdmin version but I don't see
pmaUserorpmaPasscookies being passed on my system.– MrWhiteCommented Dec 19, 2012 at 12:05 -
Hmm... I don't have more time to investigate this. I'm still not sure what is the right answer though.– jiv-eCommented Jan 23, 2013 at 13:19