Oh I miss read, you said "our". Actually no I don't, it's all hashed in the database. But if I was to post a hashed version, it's still possible to use it to log in as that user, but is more involved then just plugging it in somewhere. You either have to somehow edit your browser's cookie, or just use telnet and use the cookie: header.
Really, something I considered, even if you login to a https connection, if someone catches the right packets, they can probably resend them and login, but I assume https /ssl is more advanced then just encryption, it probably also generates a random key for that time. |