note 57503 added to security.database.storage

Be smart and simple! 1. Hash a password once on twice! It's sufficient to use SHA-1 twice! (read no.3) 2. Limit the number of log-in trys per ip! This will be a hard hit for online brute force crackers! 3. The comments below that suggest using a SALT whit MD5 ar good as long as the length of the resulting string (password + SALT) is bigger then the output of the hashing algorithm. For example: SHA-1 has an output of 160 bits or 20 ASCII chars. If the password set has 8 chars then the salt would have to be of 12 chars or longer... the longer the better! The idea here is that by trying to brute force a hash (second) that was computed from another hash (first) from a large string would result in many collisions that will make it impossible to distinguish between them and the first hash of the password! 4. If possible use HMAC for added security! This will prevent sending the same generated hash from a paswrod in the tcp/udp packets... each time the pasword field in tha data packets will contain a different hash (HMAC'ed) but on server side will be decoded to the real hash. For this you will need to design a solution for sending the password needed for HMAC! ---- Manual Page -- http://www.php.net/manual/en/security.database.storage.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+57503 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+57503&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+57503&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+57503&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+57503&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+57503&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+57503&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+57503&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+57503&report=yes Search -- http://master.php.net/manage/user-notes.php