note 94327 deleted from function.setcookie by danbrown

Note Submitter: ANONYMOUS ---- Its worth noting that most rainbow sites also give the option to convert strings into md5 sums. Whatever you do - dont go entering your passwords into md5 generators, they simply md5 the password, store the password as text and then the corresponding md5 hash. they now have a hash value for that string! for example, i generated a md5 hash code using the word anonymousUser. i then asked a few sites if they knew the corresponding hash of 3c303503151eeded4113bf1dd0ebcb11 and none did. i then put the word anonymousUser into a website and used it to generate the md5 hash. the website could then identify the hash to the word anonymousUser. A simple way to generate md5 hash sums upon request! so, basically: 1. dont go entering anything into any hash producing website. do it all yourself where you know someone wont get your hash. 2. Use some kind of random salt generator to help obscure the actual password. 3. implement some kind of captcha(which should also be salted and hashed) to ensure a human user is entering passwords. 4. restrict the amount of times a certain ip address can attempt to login per minute/hour/day. im pretty sure that implementation of the above should be rather secure!