|
its always possible to brute force, if you have access to the encrypted version. but... only if you know the encryption method. so if you use an altered version of md5... its going to be even harder to guess.
you never transmit the password or the salt in plain text. you set the cookie using the encrypted + salted password. the attacker therefore only has access to an encrypted password of which the encryption is hopefully not known.
|