Re: RFC: Storing User Info

As far as decryption goes, ignore that. When they choose as password Crypt() it with a seed. Then when the login, Crypt() what they type in with the same seed and compare to 2. Decrypting means you have the dcryption source lying around somewhere. A definite scurity problem. Crypt does a great job by being just a one-way street ----- Original Message ----- From: "Ashley M. Kirchner" <ashley@pcraft.com> To: "PHP-General List" <php-general@lists.php.net> Sent: Monday, April 16, 2001 2:41 PM Subject: [PHP] RFC: Storing User Info > > I'm looking for comments on this one. I'm developing a site that > will have user logins on it. What's the best way to do this? What to > store, and how? > > - Are people more inclined to use a username when they need to log > in to something, or would asking for an email (as the userID) be > better? > > - How about storing passwords? All of this info will be stored in > an MySQL DB. How do admins generally do this type of stuff? > Encrypt the password stored in the DB, and decrypt it on the fly > to compare? Store it in plain text? Or store it encrypted, > and when the user logs in, encrypt that passwd (from the form) > and compare the strings? (not sure if the latter would work) > > - What about sending people passwords through email? Like when > someone signs up the first time, they supply a passwd. How do > people feel about sending that login information to the user in > plain text via email? Or do you? > > - What about when the user forgets their login? Just fetch the > info from DB and mail it out to the (registered) email address? > Or, generate a new, generic one, mail that one out, and tell the > user to login and change it again? > > Suggestions please. > > AMK4 > > -- > W | > | I haven't lost my mind; it's backed up on tape somewhere. > |____________________________________________________________________ > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Ashley M. Kirchner <mailto:ashley@pcraft.com> . > 303.442.6410 x130 > SysAdmin / Websmith . 800.441.3873 x130 > Photo Craft Laboratories, Inc. . eFax 248.671.0909 > http://www.pcraft.com . 3550 > Arapahoe Ave #6 > .................. . . . . Boulder, CO 80303, USA > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > >