Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

7
  • 2
    If the server gives the client the code that does step 4, then it's trivial to defeat with active MITM. Commented Aug 5, 2014 at 8:43
  • @domen This scenario is about a program not web app so the code cannot be altered that easily. Commented Aug 5, 2014 at 8:48
  • @Nick a MiTM can intercept the client's response with the encrypted password and send it to the server first. And why is it that the code could not be altered? Commented Aug 5, 2014 at 8:52
  • @SteveDL domen was saying that if it was a webpage a MiTM can easily change the authentication code, but in this scenario the code cannot be changed by MiTMs. A MiTM can intercept the response but they would then need to bruteforce the encryption which would mean also bruteforcing the hash, and it also cant be used to resend the same packet to authenticate because the identifier will be different per login request. Commented Aug 5, 2014 at 8:55
  • @Nick if the MiTM can intercept the packet you send (whatever the form) and send another one instead, they can change the code. Commented Aug 5, 2014 at 8:57