title: Login without HTTPS, how to secure?
body: <p>For a webapplication, when HTTPS is not available as a security measure, is it possible to still make the login somewhat secure? E.g.:</p>
  
  <ul>
  <li>Tokenize logins, to make repeat attacks difficult?</li>
  <li>Somehow encrypt the sent password from a HTML password field?</li>
  </ul>
  
  <p>In particular I'm using CakePHP and an AJAX POST call to trigger authentication (includes provided username and password).</p>
  
  <p>Update on the problem:</p>
  
  <ul>
  <li>HTTPS is not available. Period. If you don't like the the situation, consider it a theoretical question.</li>
  <li>There are no explicit requirements, you have whatever HTTP, PHP and a browser (cookies, JavaScript etc.) offers in real life (no magic RSA binaries, PGP plugins).</li>
  <li>Question is, what is the best, you can make out of <em>this</em> situation, that is better than sending the passwords plaintext. Knowing the drawbacks of each such solutions is a plus.</li>
  <li>Any improvement better than plain passwords is welcome. We do not aim for a 100% l33tG0Dhx0r-proff solution. Difficult to crack is better than complicated to hack which is better than a trivial sniffing revealing the password.</li>
  </ul>