How does SSL protect the data against sniffing?
encryption, java, security, ssl
Solution
I don't have the money to buy an SSL certificate
You can't afford not to. You've already wasted more in time than the certificate will cost you.
so I thought of making one myself (theoretically with java
Not with the Java JRE alone.
The users won't trust it like they trust SSL but it would provide the security I'm looking for.
Not if the users don't trust it, it won't.
If SSL encrypts the password/info/whatever on the client's computer and than sends it to the server for decryption, what problem would there be for a sniffer to sniff the encoded password and send it to the server?
It's considerably more complex than that. The client authenticates the server's identity via PKI and the server's certificate. Client and server then negotiate a symmetric session key using the math you referred to. The key itself is never transmitted. Data is encrypted with this key, and sent along with a message authentication code that shows whether the message is intact. Because of the encryption, the data is private; and because of the way the key is negotiated, SSL also provides invulnerability to replay attacks.
Problem
I've got a small website and it's security is important to me. I don't have the money to buy an SSL certificate so I thought of making one myself (theoretically with java, although I still don't know how would I then decrypt it on the sever side). The users won't trust it like they trust SSL but it would provide the security I'm looking for. I read a few articles about SSL and I think I got the math behind it but I didn't understand How does it protect from sniffing. If SSL encrypts the password/info/whatever on the client's computer and than sends it to the server for decryption, what problem would there be for a sniffer to sniff the encoded password and send it to the server?