Suppose that I login to a website. When I type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can capture the password?
How this can be avoided?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
https is designed to prevent this kind of attack: The communication between you and the server is encrypted. The server will provide a certificate to ensure that it is the correct one and not a man in the middle.. If the certificate is signed by an certification authority trusted by your browser, the connection will be accepted automatically. Otherwise you will get a warning about an untrusted certificate. If you are in doubt, don't click it away.
There is really no excuse not to use https for login, as simple trusted certificates are really cheap or free of charge. https should be used for everything, but some huge sites argue that it uses too much processing power.
Please refrain from thinking "it's passing through an SSL stream so nobody will be able to intercept it".
It's the same thing as saying "I'm sending money via a letter, nobody is entitled to open it".
A lot of companies can generate a valid HTTPS certificate, some shady sells their certificate to unauthorized people, some other simply are vulnerable and generate certificate unwillingly, either way you can buy a certificate in the black market for less than 1000$.
I suggest to use hash challenge on top of HTTPS:
To do this you have either (1) to have the password in the server-side, (2) use an hashing algorithm which doesn't use hidden state so you can load an already hashed password from db and append the random string.
There are also other ways to authenticate using the password but without sending it.