Preferred way to obfuscate passwords over HTTP?

[Mmwwaaaa]

How do you like to prevent the odd person from sniffing your HTTP passwds?

Regards,

[HTH]

Short answer, you don't. Use SSL.

Longer less desirable answer: Client Side Crypto. Essentially forming your own SSL (crypto wise) using PKI (RSA) to share a symmetric key then sending the password over encrypted(AES) with said symmetric key.

This could still be worked around because you're missing the Certificate Authority part, and a few other things but it would stop the average fgt with wireshark.

Have I mentioned SSL?

[proxx]

What HTH said, also lol SSL doesnt have the best name at this point in time

[Mmwwaaaa]

You have, Yes. SSL sounds great....To me. Not to all.

Say a multi national company was to HTTP. They care not for SSL.. Basically my situation.

Regards,

[HTH]

Then you smack whoever you need to around until they accept SSL/TLS...

[Teapot]

I assume their issue with SSL is the Heartbleed vuln from a year or two ago?

Assure them that SSL/TLS is very secure and that while nothing is completely secure it is your best option and very trusted.

[Mmwwaaaa]

First rule, Never Assume.

[Stackprotector]

Use long passwords in combination with scrypt