The apathetic response is, of course, "there is no point." If you
allowed a login over normal HTTP, then the password was transmitted
free & clear over the wires, and anyone sniffing on those wires could
see it. Therefore, using PHP to encrypt the password before storing
it in a database is silly, as the password has already been exposed.
However, there is another kind of response, which is that having one
chink in the armor is no excuse to drop the armor and do battle
naked. A good PHP developer isn't going to let one mistake snowball
into a whole bunch of mistakes. Security isn't a guarantee, it's a
deterrent. If you make life difficult for the bad guys, they may go
find easier prospects. There are "grades" of difficulty you can
accept, but the more secure you go, the less convenient it is. For
example, you can disallow any dictionary-based passwords on your
system, to try to prevent brute-force dictionary attacks (someone runs
a script to try every word in a dictionary as the password), but then
it's harder for people to remember their passwords. You make things
too restrictive, and people find alternatives. So developers and
sysadmins are daily making decisions like this, trying to find a
balance, knowing that some protection is a better deterrent than a
wide-open system.
In addition, encryption is sometimes meant to protect from internal
threats, such as disgruntled employees, BOFH, whatever. Consider
this. An upset employee might copy a file on his way out the door.
Or a DBA might get curious one day, and start perusing the database.
Will they bother to set up a packet sniffer on the lines? No, they
don't have time or ability to pull off all that work undetected. But
an easy glance at the database? Maybe. So, like an arms race, you
just escalate the defenses to make things more difficult for
an "inside job."
Of course, protecting your data from internal threats while leaving
the data open to attack from outsiders isn't exactly a "comprehensive"
security policy, but it's clear that crypt and HTTPS are offering
different kinds of protection, meant to address different sides of the
same coin.
