note 56776 deleted from function.md5 by mazzanet
| From: | mazzanet@php.net | Date: | Mon, 03 Oct 2005 09:51:12 +0000 |
| Subject: | note 56776 deleted from function.md5 by mazzanet | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-96277@lists.php.net to get a copy of this message | ||
Note Submitter: php at REMOVEMEkennel17 dot co dot uk
----
Re: Helpful Harry's code
This code is not any less secure PROVIDED the attacker has to go through the pw_check() function to
do the comparison. In other words if they are brute-forcing by submitting to your login validation
code then there is no problem.
HOWEVER, if they have gained access to the stored hash values by some means they may well be able to
figure out that the END of the hashed string contains the START of the plaintext string (which is
quite likely given the technique has been posted to such a visible forum, but would be feasible even
if it hadn't). With this knowledge, it is _significantly_ easier to derive the rest of the
password, strip off the seed and use it to log into your system.