3

I'm using an insecure wireless network (because the secure network is currently down).

I wanted to know: When you log into MySQL, does the client program encrypt the password before sending it?

Here's an example:

mysql -h <db_address> -D <db_name> -u <user_name> -p<password> --secure-auth=FALSE

That is the login statement I currently use to connect to MySQL. If I execute this login statement on an insecure wireless network, will it send my password in plaintext across the network?

(In case you were wondering, the --secure-auth=FALSE is a parameter we use because without it the login doesn't work.)

0

1 Answer 1

3

The password isn't sent in plain text, but the old-style password scheme you're using has known issues that make it relatively easy to crack.

See http://dev.mysql.com/doc/internals/en/authentication-method.html, and the related question https://stackoverflow.com/questions/11192689/how-secure-is-authentication-in-mysql-protocol.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .