AES encryption & security flaw
Check update#1 This logic is a candidate for a authentication procedure, done by simple HTTP requests: I'm sending: userName + encrypted_userName (encrypted_userName is actually the encrypted result of userName, done using AES & as key i use the md5 hash of the password). NOTE: I'm not sending the md5 hashed Password. on the server I'm comparing: encrypted_userName with own_encrypted_userName (since on server i have access to full info on user, i calculate own encrypted_userName). Question : is this a security flaw? Say bad guy captures full HTTP request, can he extract password from this 2