    static function authenticate() {
        if (isset($_REQUEST['backend_login'])) {
            $user = DB_DataObject::factory('users');
            $user->active = true;
            $user->name = $_REQUEST['username'];
            $user->find(true);

            // Don't look whether that user exists, so we give less timing information
            // Instead, rely only on having a matching password
            $proffered_password = $_REQUEST['password'];
            if (in_array(
                $user->password,
                self::password_hashes($proffered_password, $user->password_salt)
            )) {
                // Regenerate the session ID, unless it's an IE we're talking to which would use the old session ID to load the frame contents
                // Remove this guard once we no longer use frames
                if(!preg_match('/(?i)msie /', $_SERVER['HTTP_USER_AGENT'])) {
                    session_regenerate_id();
                }
                $user->login();
                
                return $user;
            } else {
                Log::warn("Failed login for user name '".$_REQUEST['username']."' from " . $_SERVER['REMOTE_ADDR'].' user-agent '.$_SERVER['HTTP_USER_AGENT']);
                return -1;
            }
        }
        return false;
    }
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.