Sending username & password to a socket

[Kevin]

I tried searching but maybe I am not phrasing it right. Is there a standard way to send a username and password to a socket prior to or just after connecting to the IP address/port? I can't seem to find any info on this.

 

[Erel]

There is no such standard when working with raw sockets.

 

[wl]

TorThere are some guidelines though:

1. never send the plain password through the socket
2. Make some kind of handshake:

- When a socket is opened the server generates a radom value or text, stores it locally and send it to the client
- the client calculates a hash of this value with the password ( or a hash thereof) and send this to the server, together with the username
- the server does the same and compare both values

In this way you avoid someone to eavesdrop on the connection and use the data captured to pretend being someone else.

Wim

 

[moster67]

@wl

Thank you. Interesting information about the random value or text.