Interview question: Android user registration code password need to be encrypted transmission

The answer is yes, at least better than clear text.

When the client registers and logs in: a feasible method is that the client submits the MD5 (password) password (as described above, this method simply protects the password and is likely to be looked up for the password).

When registering: The server-side database stores the password through MD5 (SALT+MD5 (password)) rules, which are stored only on the server and randomly generated each time the password is stored . The cost of making a dictionary is very high even if it is towed.

After the password is submitted to the server by MD5 (), it can be compared to the database password by MD5 (salt + form[' password '). This method can implement password encryption submission and verification without plaintext storage password.

There is also the problem of preventing replay attacks (which can be verified once a request is re-issued), which is issued by the server and validates a trusted token with a timestamp (or one-time).

Of course, the transfer process with HTTPS Plus is better.

Interview question: Android user registration code password need to be encrypted transmission