Re: MD5, MySQL, and salts

On 4/18/06, Giff Hammar <ghammar@certifiedparts.com> wrote: > For an example, look at how UNIX/Linux stores regular login passwords. In > short, the salt is the first two characters in the password. When comparing > passwords, you take the salt and the user supplied password, encrypt, then > compare the two encrypted strings. If they match, the recently supplied > password matches the original. AFAIK, that is the only way to verify > passwords encrypted with a one-way algorithm. I badly worded my response, but yes you're right. Anyway I found the article I was thinking of: http://phpsec.org/articles/2005/password-hashing.html (which ironically suggests the opposite of what I said - use a random salt :P). -- Postgresql & php tutorials http://www.designmagick.com/