cb8b4546cb
When a fake handshake response is generated for a connection that hasn't received the server's handshake, the client's SHA1 would be used with a static scramble. This, in theory, would weaken the authentication to some extend so to completely prevent this, a null password is used. This removes any possibility of the password being exposed.