|
||||
|
Generally you would salt the pw before handing it over to Zend_Auth to validate.
__________________
Zym Framework - A Zend Framework extension library w/ demo app SpotSec Blog: http://spotsec.com/blog |
|
|||
|
I don't know if you still need it but I use this method:
PHP Code:
PHP Code:
PHP Code:
|
|
|||
|
if you just do md5($passwort) someone who get an dump of your Database is maybe able to search at md5.rednoize.com - reverse engineer md5 hashes for it. For Example, there is an user with the passwort md5 098f6bcd4621d373cade4e832627b4f6 now search at md5.renoize.com for it: Search 098f6bcd4621d373cade4e832627b4f6
No the "owner" of your dump is able to login with the original passwort. if you salt your passwort, for example with the login name (bad idea), the md5 for Salz`test looks like this: 99a5e84373b3bac5aeeaca03669556ed (md5.rednoize can lookup, cause i use it to generate the checksum) This makes more difficult to get the passwort. Last edited by Salz` : 02-13-2008 at 08:56 AM. |
![]() |
| Thread Tools | |
| Display Modes | |
|
|