[Ikopar]

No, the key could match on the server, it could be stored both places
It has to be send originally though, bah
Security is hard
Roombor: can i limit access to a page so that only other pages on my domain can access them? because that way they couldn't send the hash directly to the page, it's a JSP in this case

[Roombor]

maybe the random key thing will work
If you store the pass md5 encrypted server side + some random generated key
On the client side encrypt it once with the normal key, and encrypt the hash with the random key
Send it back to the server, on the server encrypt the hash with the random key, compare and generate a new random key
If they sniffed the hash it will be useless since the random key has changed

[Ikopar]

thanks, you've given me some good ideas

[Roombor]

;)