Dizkus

PostNuke should include some protection against Man-In-the-Middle and port sniffer attacks. Currently, PostNuke sends plaintext username and passwords making it all to easy for anyone with a port sniffer (like ettercap or ethereal) to see the username and password. (if you don't believe me, i can take some screenshots to show you)

My suggestion is:
PostNuke should use javascript (when available) to encode the user name and pass word before sending. There is a javascript md5 library available at http://pajhome.org.uk/crypt/md5/index.html which was released under the BSD license.

For a live example, see http://login.yahoo.com

Man in the middle? I've had dreams about that ...

--
Over 500 Xanthia and AutoThemes

XanthiaThemes.com

AutoThemes.com

thats not a bad idea ^_^ a small rewrite to the login system blam there u go ^_^

once i got the my new PostNuke is up again I will give this a try ^_^

for a good overview, examples, and the javascript library,
see http://pajhome.org.uk/crypt/md5/chaplogin.html