Which login method do you use?
dryicerx: Since most people already talk about the backend of it, let me share how to securely send the password from the browser to the server encrypted, instead of simply in clear text. (when you can't use SSL for some reason)+ Server has your passwords stored as sha1(password+salt(password)). salt function isn't secret (eg. reverse the text)- Client visits login page- Website generates random token. Then sends back HTML with the random token- Client generates passresponse = sha1(token + sha1(password + salt(password)))- Client sends the passresponse, token, and username back- Website checks for existence of token, removes it, then computes it's own sha1(token + password_hash_from_db) and checks against the sent passresponse.This way the password is never sent in clear text. Unlike HTTP authentication, this works nicely with html forms since you can do all the crypt in js. Then again, this might be a bit overkill... and using SSL is probably a better option.Just sharing another solution.