iphone登录表单的安全问题

Question

iphone.php?email=%@&password=%@ Is there any issues with sending sensitive data over the airwaves like this from an Iphone login form? Should the password be hashed before sending?

Answer 1

Is there an issue? Yes! If the users connect through an unencrypted wifi in a coffee shop, everyone can read the credentials. That is really bad, especially if you consider that the average user probably uses one password for all his accounts.

Should the password be hashed? A simple hashing, like sending the md5 sum of the password, would not help, because an attacker could simply replay the attack.

My recommendation: don't try to invent your own encryption solution, switch to SSL.