3

There is a fundamental rule here: in order to create a secure channel through an untrusted network, both ends of the channel must both possess some prior information that has been pre-shared through a trusted mechanism. The function of a Certificate Authority is to provide this shared trust without the two communicating entities needing any prior knowledge ...


1

Ok, lets take these items one at a time. I discovered that I was able to view the password in plain text at every step in the process This is actually normal. If you hash-ed the password client side then the hash would technically become the new password. Attempting to encrypt the password client side is arguably worse because clientside javascript ...


Only top voted, non community-wiki answers of a minimum length are eligible