I'm really trying to understand why my current set up is insecure. You were indicating I needed SSL because of plain text passwords and cookies. But they aren't plain text.
Where exactly is the insecurity? As I said, I'm getting an SSL but I trying to get to bottom of what exactly is insecure at the moment as it doesn't appear to be the login or the cookies.
Unless I'm being really dense I can't find anything on the WP or security forums that suggests the WP login or the comments forms have any vunerabilities.
First things first, Wordpress does *NOT* hash the password client side, it submits the username and password straight to the server and expects you to take appropriate measures to ensure that you have . Unless you have a plugin installed which is modifying the default Wordpress authentication behaviour then this assumption is incorrect.
It is very easy to check this for yourself either normal web browser development tools or packet capturing software such as Wireshark (if you aren't using HTTPS) to examine the data that is sent over the wire.
Second, the fundamental concept that adamcooke is trying to explain to you is that if the connection between the browser and the server is not encrypted, then any data which is sent can be intercepted by an intermediate third party and that third party can then use that intercepted information to authenticate themselves with the server.
If you are sending the username and password in plain text over an unencrypted connection for the server to hash and then compare against the hash in the database, then the third party can capture those and send them to the server in order to authenticate themselves.
If you are hashing the password in the browser and sending that over an unencrypted connection for the server to compare to the copy stored in the database (which by the way either means you have to store the hashes with no salt or you have to send the salt to the browser over the same unencrypted connection) then the third party can simply intercept the hash and send that to the server in order to authenticate themselves.
All you have accomplished here is that the third party doesn't know the plain text password (although with no salt then it may be trivial to brute force the password depending on the hashing algorithm used), you haven't actually secured your authentication.
Once you have logged in and the server is using a session cookie to authenticate you, if you are sending that session cookie over an unencrypted connection then the third party can capture that session cookie and use it to pretend to be you and continue your existing authenticated session with the server.
The third party now doesn't know either the plain text password or the hash, but they still have full access to the administrative dashboard for your Wordpress installation (or whatever you were trying to secure in the first place).
Ultimately, the point is simple, if the server can use the data that you are sending over an unencrypted connection to authenticate you then anyone who can intercept that data can ultimately steal that data and be authenticated in exactly the same manner. The server has no way of distinguishing between you and the person replaying the data.
Also, you need to consider that if you aren't using SSL on your entire site then the third party can transparently proxy your unencrypted connections and modify your pages on the fly so that you submit your data to their servers instead of yours. Now you think you're secure because you have SSL on your login form, but you don't realise that you never even made it to that login form! Of course, to make sure that they don't get detected easily, once they have stolen your login details they pass your authentication request on to the server and you still get logged in, so you're none the wiser!
