So, this big, reknown company (you all heard off) is sending md5 encrypted strings (with GET key: password) over HTTP.
I accidentally came over it since I wanted to use jnlp on a non-windows machine. And I am curious. Is it by definition insecure to work like this, or can it be safe when one uses SALT and other stuff alike?
The URL looks like this: url/folder/page/?login=[USERNAME]&password=[MD5-String] This URL is also stored in the corresponding .jnlp file.
I hashed my password to MD5 and it is not the same as the password in the URL.
First and foremost, I am curious. I do not have the skills to exploit this (if it where possible), and don't even want to exploit it. If you guys think I should notify the company in question: I will do so.