Posted by Willem Bogaerts on 10/01/07 09:30

Google for "challenged authentication".

The idea is this:
The server asks a question that can only be answered if you know the
password.

The server could send the client an arbitrary word that the client
should hash, using the password as salt. This salted hash is then sent
to the server for verification.

Store the generated word in the session and clear it upon successful
login. This ensures you can only login once if someone monitors the
network traffic and the pre-login session. (You DO regenerate the
session upon successful login, don't you?)

Good luck,
--
Willem Bogaerts

Application smith
Kratz B.V.
http://www.kratz.nl/

[Back to original message]