The hash is sent over the network to the server. The server does the same
thing and if the hashes match the user's password is valid.
So the SIMS box verifies the "encrypted"/hashed password and if valid, allows access.
No. the password is never sent.
let's say your password is "fred"
some information from the greeting banner is encrypted using "fred" as the key (or seed). The server then takes the encrypted string and sees if it matches IT'S encryption of the same portion of the greeting banner. If they match, the password is correct.
Wouldn't that tend to be more secure than leaving the other setting open?
I don't understand your question. APOP is more secure than sending cleartext passwords. This has nothing to do with any other server settings though, it only applies to the password phase.
--
If we get through this alive I'll meet you next week same place same time
############################################################# This message is sent to you because you are subscribed to the mailing list <[EMAIL PROTECTED]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
