[ANSWERED]Securing Login Credentials

[rkanemeier]

Let's say I deploy a web application through Valence (on the iSeries). I set up Valence to use iSeries user/password. When I pull up the debug console in Chrome, then log into the Valence portal, when I click on the network tab, and inspect the login.pgm action, I can see my userid and password clear as day.

If this application is accessible from outside our network, does that mean our userid and passwords are crossing the web in plain text format?

I did this on a few different websites (my bank, a credit card company, etc), and again, I can see the password in the network tab when the form is submitted. Is this a security concern? If the site is using SSL, does that data pass through encryption prior to being sent back and forth to/from the server?

[richard.milone]

Being able to see the clear text password is totally normal in Chrome Tools. This will usually be the case because Chrome Tools picks up the field values before they are encoded and sent through the network. And as you noticed it's the same with your banking websites. If you make Valence available to users outside your network you should definitely be using SSL. You will still be able to see the password in Chrome Tools in your browser but the password (and all data traffic to/from Valence) will be encrypted across the network. In Valence 4.0 the password will be UTF16-encoded in all cases so you won't be able to see it in clear form in Chrome Tools. It could be easily decoded from UTF16 but at least it wouldn't be directly viewable in Chrome. You should still be using SSL for any outside connection. For inside connections it's probably not necessary to use SSL if your network is reasonable secure from outside intrusion.