note 12321 deleted from function.crypt by jimw
| From: | jimw@php.net | Date: | Sat, 03 Nov 2001 18:18:48 +0000 |
| Subject: | note 12321 deleted from function.crypt by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-20374@lists.php.net to get a copy of this message | ||
Do not authenticate using MD5, especially with passwords, because if I have the MD5 hash of a
working password, it is trivial to determine the original password that produced the hash.
Yes, there are 2^128 possible hashes, but a PIII 500 can calculate around 750,000 of those per
SECOND.
6 characters passwords can be brute-forced within hours.
8 character passwords within a few days.
Proof?
http://mdcrack.multimania.com/