<p>If I use restful_authentication in my ruby on rails app are passwords transfered between the broswer and the server in paintext? And if so how worried should I be about it?</p>

[{'answer_id': 53519, 'author': 'Mike Stone', 'author_id': 122, 'author_profile': 'https://Stackoverflow.com/users/122', 'pm_score': 2, 'selected': False, 'text': '<p>Well, you need to be worried if you are not hosting it over HTTPS... because if it is straight HTTP, then yes it is being passed in plaintext.</p>\n\n<p>I don\'t know Rails specifically, but I\'m pretty sure it has nothing to do with whether you host it via HTTP or HTTPS.</p>\n\n<p>Edit: I found <a href="http://blog.caboo.se/articles/2007/4/21/sample-rails-app-branch-with-ssl" rel="nofollow noreferrer">this link</a> which apparently provides an example Rails app over HTTPS.</p>\n\n<p>Further Edit: Here is <a href="http://weeatbricks.com/2007/10/31/how-to-use-a-rails-app-with-https/" rel="nofollow noreferrer">another link</a> discussing HTTPS with Rails.</p>\n'}, {'answer_id': 53521, 'author': 'Daren Thomas', 'author_id': 2260, 'author_profile': 'https://Stackoverflow.com/users/2260', 'pm_score': 0, 'selected': False, 'text': "<p>Authentication with plain text can be done with CHAP style protocols. Is that possible over HTTP?</p>\n\n<p>I'm asking, because I think that it would need some state on the server to foil replay-attacks - state on the server is something to be eliminated with RESTful architectures, right?</p>\n"}, {'answer_id': 232301, 'author': 'two-bit-fool', 'author_id': 23899, 'author_profile': 'https://Stackoverflow.com/users/23899', 'pm_score': 2, 'selected': False, 'text': '<p>If you are concerned about the privacy of passwords (and <a href="http://www.betterthansimple.com/blog/2008/06/26/always-encrypt-passwords/" rel="nofollow noreferrer">you should</a> be), you will also want to add this line to your ApplicationController:</p>\n\n<pre><code>filter_parameter_logging :password\n</code></pre>\n\n<p>Otherwise the passwords will end up in plain text in your log files.</p>\n'}, {'answer_id': 20450787, 'author': 'Severin', 'author_id': 1213273, 'author_profile': 'https://Stackoverflow.com/users/1213273', 'pm_score': 0, 'selected': False, 'text': '<p>You should definitely have a look at the bcrypt gem. It will hash all passwords for you. </p>\n'}]
['https://Stackoverflow.com/questions/53511', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/4474/']