0

My webhost doesn't allow SSL certificates for my webhosting product since it is a shared IP server. (I would have to upgrade the product and pay a lot more money, which I don't want to at the moment) I don't really need all of the website encrypted, I only want to give the password (and username) submission on login a bit more protection. Is there a module that just does some asymmetric encryption on the password on submission, e.g. with JavaScript?

Note: I know about the possibility of Man-in-the-Middle attacks with this setup.

  • Also relevant: security.stackexchange.com/questions/23006/… – Felix Eve Feb 14 '14 at 15:52
  • @FelixEve, fair point... – Turion Feb 14 '14 at 15:53
  • @Turion I think this is a pretty straight-up dupe of the question so I've closed it...if you disagree please let me know and I'll open this one back up again – Clive Feb 14 '14 at 15:54
  • @Clive, I don't think it should be closed. The functionality is similar, yes, but the user experience should be a different one - the answer to the other question recommends installing additional software or using SSL, both impossible for me. Also, the security implications of my questions are much more serious than those in the other question and would need to be addressed. – Turion Feb 14 '14 at 15:59
  • Fair dos, I've re-opened it. I wish you the best getting an answer, but I highly doubt you'll get one that satisfies all of your conditions. There's a very good reason people stay as far as possible away from client-side encryption on the web - it ain't secure – Clive Feb 14 '14 at 16:04
0

So far, the only way that I've found to encrypt user login without SSL is the Encrypt Submissions Module (https://www.drupal.org/project/encrypt_submissions)

It uses the jCryption library (http://www.jcryption.org/) to encrypt the username and password that drupal offers up in clear text otherwise. Fairly straightforward to set up. The only server requirement is bcmath php module which most servers have anyway.

I use Encrypt Submissions whenever I can't use SSL, not as a replacement. You may want to consider switching hosts if they don't allow SSL certs, they sound pretty backwards.

  • But its doesn't work well, login form is reloaded its shows in console the encryption key but its doesn't redirect to user's dashboard – Sumit Aggarwal Feb 23 '17 at 5:05
  • please provide help to get out rid the errors of this module – Sumit Aggarwal Feb 23 '17 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.