a more secure schema : was [PHP-DB] JScript MD5 function?

On 5 Oct 00, at 3:45, Dean Hall wrote: > If you see any flaws in this HTML page or in my authentication system, > let > me know. Hello, i see at least a couple of serious securtity holes, but again i am no security expert :) 1) this scheme forces you to use cleartext password in your db, which is the reason why I (as a software engineer) would accept a punch on my nose from my contractor (if i was to use cleartext passwords..). But there is a easy workout.. FIRST you MD5 the password.. THEN you MD5 the result of the first hashing with the "seed" .. this way.. server side you can still check validity if you have the MD5 stored in the DB. the concept of md5 "salting" coulld be added for extra security. 2) you are basically opening the system to any hacker with a packet sniffer.. Although he will never be able to retrive the password he can always generate a HTML page with the SAME seed that was provided to your user and give back the SAME hash that your user gave back. in other word your seed doesnt expire! a tecnique for solving this is to make sure the seed expires.. that is to send an exact time (e.g. 12:11 - 2 may 2000) with your signature on it (a md5 of the time withs ome extra text on it e.g. MD5("12:11 - 2 may 2000"+"life is beautiful"); then when you get back the data from the form you check you are withinin 3 minutes or so from when the page was issued.. this way your hacker could use that same password for just 3 minutes. More security could be addedf by adding the IP into the hash or using unique numbers taken from a random generator with a secret key. but anyway :) please some1 let me know if i am wrong or if there are easier ways to implement this.. more than that please let me know if such implementation has already been nicely written by some1 so i donthave to do it myself. Thanks. Giovanni Tummarello tummarel@ascu.unian.it Fight Spam! Join CAUCE (Coalition Against Unsolicited Commercial Email) at http://www.cauce.org/ and tell your Congresspeople how Spam mailings hurt you. Help protect genuine Internet commerce: Outlaw UCE Spamming.