在提交之前用javascript加密密码是否有意义？

Question

I'm following the example on http://marakana.com/blog/examples/php-implementing-secure-login-with-php-javascript-and-sessions-without-ssl.html

The thing I don't fully understand is what is the gain by doing this? The secret word is posted in the form, so anyone who might be sniffing would surely see that secret word, as well as the javascript and be able to figure out the password anyways. Does it really make sense to do this?

Answer 1

An eavesdropper would not be able to derive the password, because they only know:

• the secret word
• the hash of the secret word/password combination

Since hashes are one-way, you cannot derive the password itself from these.

What you gain : The user has set up a password which the server is able to verify, without having to send the plaintext password itself.