使用php和java进行密码加密

Question

I am confuse regarding aspects of password encryption the following scenario. While debugging a network response from a Android app using fiddler or wireshark which create a type of proxy server that allows me to see whatever request going from the app to the server. In the response in raw format is the password and it is clearly visible in the post request. As on server end by using password_hash and password_verify we are protecting password. But if someone else on network end can view password then encryption at server end is no use. Is their any way I can send encrypt password from app and it's converted in some other form and after that password _hash function encrypt it. (even in HTTPS I can see post request)

Answer 1

The solution to securing the password in transit with HTTPS is to "pin" the certificate. Essentially that means to verify that the certificate received on establishment of the connection is to the correct server.

MITM and proxy attacks use a certificate that is not a valid certificate for the server and will be refused.

See: HTTP Public Key Pinning .