We have had encryption, we have had SSLs, ... well we also had digitally signed certificates, but where's the hack?? This somehow is a example towards making a login script in php that:
[1] doesn't send the login information in clear-text
[2] won't let anybody else use sniffed information to login, in short, resistant to replay attacks ...
Preparin