How do you encrypt passwords?

[Luke]

For those who develop applications using sensitive user data, how do you store passwords? bcrypt, md5 (please don't), plain text (PLEASE DON'T) etc?

 

[pandaa]

Re: How do you store passwords?

What is your opinion on passwords encrypted with MD5 that have also been salted? That's what I've used in the past. MD5 is pretty weak, especially if you have a weak password encrypted with it, but I think a salt greatly increases the difficulty of cracking it.

 

[Carson]

Re: How do you store passwords?

Generally SHA-256.

 

[jank858]

Re: How do you store passwords?

I put all of my passwords on sticky notes. lol

 

[Deleted member 25872]

Re: How do you store passwords?

I store passwords in my head! 🙂

 

[Luke]

Re: How do you store passwords?

I put all of my passwords on sticky notes. lol

I store passwords in my head! 🙂

Don't think you two get it, I mean storing peoples passwords when developing an application: ie: PHPBB etc. 😛

 

[D]

Re: How do you store passwords?

Base64... lelleleljkjk


This is how I currently do it in my authentication class.

Password:
md5 the password
SHA-512 the md5

Username:
md5 the username
SHA-512 the md5

Then finally salt the password string with the username string. md5 then SHA-512 the result.

Tada.

 

[Cosmic]

Re: How do you store passwords?

I typically use a PHP implementation of PBKDF2.

PBKDF2 stands for Password Based Key Derivation Function 2. It's kind of like using double-SHA, except it iterates a few thousand times instead of 2 times. It can use any of the SHA algorithms, ranging from good ol' sha1 to sha256. It also uses a salt, etc.

Newly developed apps should probably use either PBKDF2 or Blowfish. I use PBKDF2, as it's a bit easier to implement, and also because it's endorsed by the National Institute of Standards.

 

[Addicted]

Re: How do you store passwords?

I put all of my passwords on sticky notes. lol

Desktop sticky notes or ones in real life?

 

[lionel.web]

Re: How do you store passwords?

I think md5 with a hard to find salt is enough.


There is no way someone to find it..

 

[Accolayd]

Re: How do you store passwords?

SHA512 or md5 hash with salt key

 

[int0x10]

Re: How do you store passwords?

MD5 certainly isn't secure enough for passwords in my opinion. Just take a look at this CodingHorror article about hash cracking times; in particular, the fact that a nine character MD5 password could be cracked in 10 days with a high-end home PC.

bcrypt would definitely be the weapon of choice for me, or perhaps even scrypt (which is more resistant to GPU attacks), plus a decent salt. PHPass is a good PHP library for a web application storing passwords.

 

[lionel.web]

Re: How do you store passwords?

if use md5 with salt, and md5 again the md5 password with a new salt, will be still easy to be hacked?

 

[Cosmic]

Re: How do you store passwords?

if use md5 with salt, and md5 again the md5 password with a new salt, will be still easy to be hacked?

Yep. Any algorithm which uses md5 is vurnerable to being exploited. The only truly secure options are PBKDF2 and Blowfish, at the moment.

 

[jacktheking]

Re: How do you store passwords?

I think md5 with a hard to find salt is enough.


There is no way someone to find it..

http://lmgtfy.com/?q=MD5+Database

---

Personally I use a very strong and secure algorithm. Recommended by PHP.. PHP Password API. Of course, I did not stop there.. I came out with another algorithm that encrypt the password even better. I'm not going to share with you guys.. 🙂

 

[Cosmic]

Re: How do you store passwords?

Personally I use a very strong and secure algorithm. Recommended by PHP.. PHP Password API. Of course, I did not stop there.. I came out with another algorithm that encrypt the password even better. I'm not going to share with you guys.. 🙂

Security through obscurity is generally not a good way to go. If an algorithm is truly secure, then you should be able to release the details of the algorithm without any concern.

 

[Chris K]

Re: How do you store passwords?

I store them in my head :]

 

[Cierra]

Re: How do you store passwords?

I store them in my head :]

I think they are asking you how you store passwords when making an application/software. 😉 Whether it be an algorithm, plain text, etc.

 

[Abdul Raheem]

Re: How do you store passwords?

i store passwords in php language encripted form md5 function.

 

[int0x10]

Re: How do you store passwords?

i store passwords in php language encripted form md5 function.

As people were discussing earlier, MD5 is not secure enough. You should use Blowfish or something 😉