Private registration example (in authenticated environment)
Type in a username, adminpass (simplebart) and a password, and see the encryption being performed.
The new users password is first validated, then md5'ed, then split in four 8-char parts. The four parts is replaced into the javascript-generated 256 char hash bigstr_b (which itself is printed into the form by javascript, inside the hidden field which is its container).
The hash is then 3DES-encrypted, using the first 24 chars of the key, constructed from the double md5-value of the adminpass, md5'ed again with the admins seed for uniqueness.
Finally, a hex-string of the 3DES-binary is printed into a hidden field and submitted together with the username for the new user.
All other values are cleared pre-submit!
The only values to leave the client are username for the new user, the 3DES-hex and the admins cookie-data!
Some fields in this form are normally hidden, but displayed as text here for illustration purposes. There are also some additional hidden fields in this example to help to the illustration. In the REAL form, the only values submitted are the username and the opaque hash!
|