Re: Security alert: phpmyadmin

[Rolf Hopkins]

> Michael Widenius wrote:
> >
> > The encrypted password is the real password in MySQL;  The password is
> > only encrypted to not let one guess your real password;
>
> Does this mean that when connecting to MySQL using perl (or even the
> MySQL client) over a network, the following occurs?
>
>   DBD::mysql first encrypts the password.
>   It then sends the encrypted password to the MySQL server.
>   The MySQL server compares it to the stored encrypted password.
>   If they match, let the user in.
>
> If so, couldn't someone sniff the packets and get the encrypted password
> anyway?

I would have thought that the password would get sent to the mysql server
before being encrypted for comparison!!!

Cheers

Rolf