0

I've moved my WordPress site onto a https server, but now I'm wondering if I still need to manually encrypt the login credentials for my remote login.

Is the default login encrypted before it is sent? Everything I've read, code included, is all plain text which is really bad for http sites.

In my other projects we used something like an md5 hash to encrypt the password before sending it. But I don't have that project and I don't know if WP is storing plain text passwords or hashed. So I'd rather use existing WP login code if it's available or an example code of how to encrypt it before sending it would help.

PS I'm logging in via a remote application.
PSS I've also seen the other posts and this is not a duplicate.

  • encrypt where, server or client?, what is a "remote application"? – Mark Kaplun Feb 8 '16 at 3:37
  • Encrypt on the client. A remote application being a desktop application that makes a URL Request using POST, GET. So to login, I provide a URL, set the post or get name and value pairs and then submit. I don't think it matters. If something is written in JS I can send the same values from the application. – 1.21 gigawatts Feb 8 '16 at 3:45
2

wordpress do not encrypt anything at client side, but encryption on client side do not help at all with security, it just make password stronger but do not help at all against Main In The Middle, or eaves dropping attacks. No matter how strong is your password encryption, if you send it over HTTP, once I know it, lets say by monitoring wifi traffic, I can use it myself.

Using HTTPS is the only real solution as the protocol layer ensures that everything is encrypted in a unique way per each connection therefor no one can repeat the same packets and gain access as it will fail in the protocol level.

short answer: with HTTPS you don't need to "encrypt" the passwords you send on the wire.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.