title: Is there a way to securely send information in Ajax?
body: <p>I'm currently developing an application in HTML+JS based almost entirely in ajax connections (using the <code>jQuery.ajax()</code> call to ease the process).</p>
  
  <p>I was thinking about the best practice to make secure calls without using HTTPS (at least at this time. I can't afford paying for a certificate right now).</p>
  
  <p>At this point, the only thing that concerns me is the registration and login steps. Maybe the login is a bit easier. I thought of <strong>sending the username and a timestamp, and then encrypt them using the user's password.</strong> So, by doing this, I wouldn't be sending any password (keeping as a secret like in OAuth). The server should check the user, decrypt using the password and pairing the recieved timestamp with the decrypted result. The server should keep the <em>nonce</em>-like number into a database (to avoid repetition attacks) and then give back to the user another unique id (encrypted with the user's password). At that point the user should start using that key to encrypt all his information (and probably another nonce) and send it to the server. Please correct me if you find any mistake or leak.</p>
  
  <p>The very big problem to me is the registration. I can't encrypt with a regular password the information, because if I do that in the javascript, any could know the password. If I serve temporary generated passwords to encrypt and I send it from the server to the client, any sniffer could get it and use to decrypt the info.</p>
  
  <p>I know HTTPS could save my life at this point (and maybe that's the only solution), but at this point I'm not able to use it.</p>
  
  <p>Is there any other solution, or should I wait until I can use HTTPS? Bear in mind that if I could skip the wait, it would be better. Thanks mates!</p>