javascript - Client side 100% secure password POST -

I came to avoid sniffing posts to steal the password with this principle. This idea is to add a salt string (generated at random php session_start ()).

Please note Give, salt_hash is randomly generated on every access ... it is not done in the customer's favor.

Basically the JS code will be added to HTML:

    
 So before posting it, I'll calculate ...  
  cryptoPass = md5 (md5 (password) + salt_hash); passowrd = ''; // Clear user password input submitted postage ...; Then at login.php I compare $ 5 _POST ['cryptoPass'] with MD5 (mysql user password stored with MD5, plus salt_hash)   < p> Does it really work or is this a nonsense?   
 
 
 First of all, I will start with a side note, the first rule is to create your own crypto And does not attempt to use there are professionals who are very good at making crotos algorithms, and people are still able to crack them.  
 Your plan does not really add much security to this plan if an attacker knew that you were calculating swans with this:  
 
 cryptoPass = md5 ( md5 (password) + salt_hash);   
 Use the same algorithm if they knew the salt value. It does not add almost any security because it takes approximately equal time to crack:  
 
 cryptoPass = md5 (password + salt);   
 Cracking algorithm because it is the same complexity at the same time  
 The best solution here is to just use TLS, which is easily implemented.  
 and  Context of client side 100% safe  Insert anything   is unreal, unfortunately 100% there is no way to secure something. If man has made it, then with enough time, this man can crack it.  
 
  Why it is bad to use hashing + salt on the client side as an encryption mechanism:   
 Suppose you use random hashing As you have mentioned, the client starts the login sequence with the server and the server sends it the salt value:  
 
 718904732197   
 The attacker is now using salt Know the value now, the customer keeps his password using his hashing function:  
 
 cry PtoPass = md5 (md5 (password) + salt_hash);   
 The salt hash is random, but it is known and algorithm, by which an attacker uses a simple brute force algorithm to cut the hash (this is the simple 6 digit passwords for seconds to circumvent Will take the case). They can also use dictionary attacks against rainbow table and hash to increase cracking speed.  
 An attacker will produce a hash by using your known work:  
 
 cryptoPass = md5 (md5 (password) + salt_hash);   
 And they already know the salt value, they will remove the password from the hash using the brush force. Now they have a clear text password and probably have a username so that they can now enter that user's account.  
 
 Perhaps it will help you:  
 Is it better to have no security? Yes  
 Hashing is better than hashing alone? Yes  
 Is using a random salt value more secure? Yes, to an extent  
 All this aside, the scheme you are using is not safe from today's standards. Your entire algorithm in an experienced cracker can be in just a few hours.