note 68960 deleted from security.database.storage by joey

Note Submitter: roysimkes at hotmail dot com ---- But the thing in double hashing is to increase the time that they can crack your password! A passwod that takes a year to break is quite secure(!) And even if they learn somehow that you are double hashing your passwords, how will they learn which one you are using first! Instead of using md5() twice try using sha1(md5()) or vice versa. An the breaker should check more things. For only one password he has to check at least 4 different types (md5 only, sha1 only, md5(sha1) and sha1(md5) ) it will take quite a time to break it! (Yeah if he can see your source files it doesn't mean anything. But if they can see that files, you are already dead in the water) And also put a salt variable in it! If that's random salt, it will take a very long time to crack the password. The best security is to use a hybrid solution. If you add salt to your passwords they have to use your app to crack the code. And if you add some more features like after 3 times password failure add a secret question and a secret answer, a visual confirmation code! Things are getting complicated for the automated script! Well yes if you want to protect something, do not publish them in the internet. With enough dedication, time and resources every password can be cracked. But if the time is more then years, who will waste time on it? Or the password to be cracked worth that time?