Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am currently writing up on HTTP and HTTPS and the advantages of HTTPS. I was thinking, is it possible to securely send data to a server i.e login, which is just HTTP. The result I was thinking that the login credentials are encrypted before being sent e.g. aren't readable (using wireshark) but the server can still retrieve the information.

I can understand why this wouldn't be possible, how to make the server the only one to read the credentials.

Again this was just a thought.

share|improve this question

closed as not a real question by slhck Nov 14 '12 at 11:55

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Right now this is not a question and also completely off-topic here on Super User. However, it might fit on Information Security after some rewording to turn it into a proper question. –  ThiefMaster Nov 14 '12 at 11:37
    
Sorry about that. Only really use Stackoverflow of the Stack exchange sites. I do think though it is a question –  Dan1676 Nov 14 '12 at 20:12

1 Answer 1

up vote 0 down vote accepted

It is actually possible. You could implement the cryptographic algorithms SSL uses in client-side JavaScript and encrypt your date with a public key. Only the application on your server would have the corresponding private key and thus nobody could read the data even when using plain HTTP.

However, there is one big disadvantage compared to SSL: You are not protected from Man-in-the-Middle attacks (who would replace the public key with one where he has the private key). Doing the same with HTTPS would require a corrupt/malicious CA or the user accepting an invalid/self-signed certificate.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.