RE: [PHP] update password cookie
| From: | Chris W. Parker | Date: | Thu, 18 Sep 2003 23:18:20 +0000 |
| Subject: | RE: [PHP] update password cookie | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-163069@lists.php.net to get a copy of this message | ||
John Kaspar <mailto:ljbn@hotmail.com>
on Thursday, September 18, 2003 4:05 PM said:
> I'm just storing its hash. Then comparing it to the database hash.
> Is that bad? Is there a good write-up somewhere discussing
> authentication techniques that you could recommend?
Oh I should respond to this as well.
This is just a little better than storing a plain text password. Reason
being
that the next person that uses that computer can read the cookie and
steal the hash. They would then be able to reverse* it and get the
password so they could log in like a normal user.
Chris.
* By reverse I don't mean "decrypt" or "unencrypt".