News Feed

News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way
Just Hashing is Far from Enough for Storing Passwords (Dictionary & Rainbow Attacks)
March 09, 2010 @ 13:11:01

On there's a new post that reminds you that hashing isn't enough anymore to protect your users and their passwords. They offer a suggestion or two of what you can do to help lock things down a bit more.

The common practice is to hash the user password and store the hash string of the password in the database. When the user tries to log in and supplies his password, it is used to generate a hash string to be compared to the one stored in the database. [...] This approach may be secure in the 70s of the last century, but barely any more.

Computing has evolved enough to where hashed can be matched, sometimes in less than two or three minutes. Their answer to the problem? Generate a random salt each time you create the hash with a constant being used as a base. A code snippet calling a user-defined function and the sha1 function are included.

0 comments voice your opinion now!
hash password salt dictionary rainbow attack

blog comments powered by Disqus

Similar Posts

Anthony Ferrara's Blog: Properly Salting Passwords, The Case Against Pepper 5.3.7 upgrade warning

Chris Hartjes' Blog: Don’t Fear The Command Line: Using CakePHP Shells Basic PHP Script Security

Jakob Westhoff's Blog: From Revelation security to Android password managers

Community Events

Don't see your event here?
Let us know!

version artisanfiles release podcast symfony security tool composer language conference list library introduction series laravel opinion interview voicesoftheelephpant community framework

All content copyright, 2014 :: - Powered by the Solar PHP Framework