Posts Topics Forums Images
Search videos from message boards Videos Search messages from microblogs Microblogs Search messages from imdb.com Imdb Search messages from yuku.com Yuku Search messages from lefora.com (free forums) Lefora
My account: Login | Sign Up
Loading... 

Thread: Password encoding/decoding - PHP

Started 2 years, 2 months ago by ezb
I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method? Any help would be geat, also any other information regarding safety, thanks.
Site: www.daniweb.com - IT Tech Talk  www.daniweb.com - IT Tech Talk - site profile
Forum: PHP  PHP - forum profile
Total authors: 6 authors
Total thread posts: 19 posts
Thread activity: no new posts during last week
Domain info for: daniweb.com

Other posts in this thread:

ezb replied 2 years, 2 months ago
Thanks alot for your help, however, I am using 4.3.9, sorry I should have mentioned this to begin with, the code you gave strictly php5?

stymiee replied 2 years, 2 months ago
Here is a good PHP5 class that uses the mcrypt library for two way encryption. php Syntax ( Toggle Plain Text ) <?php class Encryption { static $cypher = 'blowfish' ; static $mode = 'cfb' ; static $key = '1a2s3d4f5g6h' ; public function encrypt ( $plaintext ) { $td = mcrypt_...

stymiee replied 2 years, 2 months ago
It can be changed to work with PHP 4. You just need to change the PHP 5 features to 4: php Syntax ( Toggle Plain Text ) <?php class Encryption { var $cypher = 'blowfish' ; var $mode = 'cfb' ; var $key = '1a2s3d4f5g6h' ; function Encryption ( ) { // do nothing }...

bennyfreshness replied 1 month, 3 weeks ago
can this store, say for instance, a PayPal token that I am supposed to keep hidden?

jomanlk replied 1 month, 3 weeks ago
You can do it at the database level as well if you want. For INSERT Help with Code Tags PHP Syntax ( Toggle Plain Text ) $aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1" ; $sql = "INSERT INTO user(username, pass) VALUES ('bob', AES_ENCRYPT('password', '$aes_key' ))" ; $aes_key = "EF77FHH7-E6G1-31y4-w2D7-G4gH8HWF20H1"; $sql = "INSERT INTO ...

Atli replied 1 month, 3 weeks ago
Hey. Be careful if you do this in a SQL query tho. Some MySQL servers use plain-text query logs, so while your passwords might be encrypted in the database itself, they would be stored in their original form in the logs. See these two pages in the manual for details on that.

jomanlk replied 1 month, 3 weeks ago
@Atli Good point. I didn't know this. This can be a problem if your MySQL server is not controlled by you alone.

digital-ether replied 1 month, 3 weeks ago
• • • • Originally Posted by ezb I am currently building an online system, it has come to the point to think about securing peoples passwords. How ever, for admin reasons I was wondering if it was possible to decode the encoded password, I believe this is not possible with md5 but hoping there is another method? Any help would be geat, also any other...

Atli replied 1 month, 3 weeks ago
@digital-ether I agree with you 100%, although 100.000 iterations seem a bit excessive to me. (But that's just me :-P) However, I got to ask why you specifically mention high memory usage?

jomanlk replied 1 month, 3 weeks ago
I think she recommended high memory usage so that the effort needed to try to recreate/hack any of the passwords would be excessive and not worth it. But if you use up that much processing/memory, wouldn't you make it untenable to be used within a login/registering system? For even a reasonable amount of requests even.

 

Top contributing authors

Name
Posts
digital-ether
6
user's latest post:
Password encoding/decoding -...
Published (2009-11-07 00:00:00)
&bull; &bull; &bull; &bull; Originally Posted by Atli Thanks. I did use an array at first, adding each hash as an element and them imploding it before creating the final hash. (Like you do in your code.) However, after testing that I found that this method uses double the amount of memory the string concatenation method uses. Makes sense when you think about it. Both the array and the string will have to exist in memory at the...
Atli
5
user's latest post:
Password encoding/decoding -...
Published (2009-11-07 00:00:00)
Thanks. &bull; &bull; &bull; &bull; You could optimize the string concatenation. I did use an array at first, adding each hash as an element and them imploding it before creating the final hash. (Like you do in your code.) However, after testing that I found that this method uses double the amount of memory the string concatenation method uses. Makes sense when you think about it. Both the array and the string will have to...
jomanlk
3
user's latest post:
Password encoding/decoding -...
Published (2009-11-05 00:00:00)
I think she recommended high memory usage so that the effort needed to try to recreate/hack any of the passwords would be excessive and not worth it. But if you use up that much processing/memory, wouldn't you make it untenable to be used within a login/registering system? For even a reasonable amount of requests even.
ezb
2
user's latest post:
Password encoding/decoding - PHP
Published (2007-10-15 15:07:56)
Thanks alot for your help, however, I am using 4.3.9, sorry I should have mentioned this to begin with, the code you gave strictly php5?
stymiee
2
user's latest post:
Password encoding/decoding - PHP
Published (2007-10-16 11:07:56)
It can be changed to work with PHP 4. You just need to change the PHP 5 features to 4: php Syntax ( Toggle Plain Text ) &lt;?php &nbsp; class Encryption &#123; var $cypher = 'blowfish' ; var $mode = 'cfb' ; var $key = '1a2s3d4f5g6h' ; &nbsp; function Encryption &#40; &#41; &#123; // do nothing &#125; &nbsp; function encrypt &#40; $plaintext &#41; &#123; $td =...
bennyfreshness
1
user's latest post:
Password encoding/decoding
Published (2009-11-05 00:00:00)
can this store, say for instance, a PayPal token that I am supposed to keep hidden?

Related threads on "www.daniweb.com - IT Tech Talk":

Related threads on other sites:

Thread profile page for "Password encoding/decoding - PHP" on http://www.daniweb.com. This report page is a snippet summary view from a single thread "Password encoding/decoding - PHP", located on the Message Board at http://www.daniweb.com. This thread profile page shows the thread statistics for: Total Authors, Total Thread Posts, and Thread Activity