title: Two-way password encryption without ssl
body: <p>I am using the basic-auth twitter API (<a href="https://groups.google.com/d/topic/twitter-development-talk/wD-isa6Q0qk/discussion" rel="noreferrer">no longer available</a>) to integrate twitter with my blog's commenting system.  The problem with this and many other web APIs out there is that they require the user's username and password to do anything useful.  I don't want to deal with the hassle and cost of installing a SSL certificate, but I also don't want passwords passed over the wire in clear text.</p>
  
  <p>I guess my general question is: <strong>How can I send sensitive data over an insecure channel?</strong></p>
  
  <p>This is my current solution and I'd like to know if there are any holes in it:</p>
  
  <ol>
  <li>Generate a random key on the server (I'm using php).</li>
  <li>Save the key in a session and also output the key in a javascript variable.</li>
  <li>On form submit, use <a href="http://tero.co.uk/des/" rel="noreferrer">Triple DES in javascript</a> with the key to encrypt the password.</li>
  <li>On the server, decrypt the password using the key from the session and then destroy the session.</li>
  </ol>
  
  <p>The end result is that only the encrypted password is sent over the wire and the key is only used once and never sent with the password.  Problem solved?</p>