Vulnerabilities

[tatemuin]

a)seemes that user credentials are sent to /administrator/index.php in clear text and
b)from administrators PC because Password type input named pass from form named loginForm with action index.php has auto-complete enabled). My Question is how secure is this interface as far as hacking is concerned and if not what can be my solution to it.

[dylanjh]

a) Yes it will be unless you make the admin interface use ssl, there are a number of extensions in the JED that will do this.
b)I dont fully understand this, but I presume you are referring to the autocomplete feature most browsers have to make logging in easier. The only option is to disable this functionality in the browsers settings.

As far as securing the admin area, I normally use .htaccess to prevent anyone but my ip from accessing the administrator folder. You will need a static public IP for this however

[tatemuin]

Thank you on the first part on the user credentials i hope i will try to make head n tails out of your reply, to use SSL. i will need to rephrase on the other part (b).