>Can someone tell us what is going on with what the user below is mentioning >in their email to us? We had one of the guys in our office do the same thing >and just like our customer says in the email below the password in the web >mail interface was sent in plain text.
This is normal. Standard web transactions (HTTP) are not encrypted in any way, and there is no standard for transmitting passwords through HTTP (except for "Basic Authentication", which sends passwords that are encoded, but not encrypted). HTTPS (using SSL) is the standard for secure connections for web transactions. Note that Hotmail uses HTTPS/SSL. Logging on to Yahoo (from http://auctions.yahoo.com) was done using HTTP using cleartext passwords. Also, while eBay uses encrypted passwords on URLs, it uses HTTP by default (and the encrypted password, if stolen, can be used -- there's no challenge/response mechanism). If you want your password sent securely, you'll need to use SSL. Note that sending an encrypted password using HTTP isn't feasible -- you would need huge amounts of JavaScript/Active-X code to encrypt the password. -Scott --- Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
