How to store passwords ?
Passwords are secret keywords/keyphrases that are used to distinguish legitimate users from others.
Many years of research is involved in storing passwords. Here is a list of industries best practices on storing passwords. Hashing !
To establish that hashing is a good way to store passwords lets take a look at the other methods and then compare them with hashing to find out their weaknesses.
The advantage of storing passwords in hashing is that even if someone is able to extract all the hashed passwords as well as the source code. It will not be easy to crack the passwords. If passwords are stored in plain text, then stealing the database alone will allow an outsider to be able to log into the system.
If the passwords are stored in an encrypted format then an outsider will require both the database as well as the source code to decrypt the passwords and log into the system.
Hashing passwords will keep the passwords secure to a large extent even if an outsider is able to access the source code as well as the database.
What is a hash?
A hash is a unique fixed length content that is created using the original password. There are three distinct properties of a hash that make it the ideal choice for storing passwords.
- Hash of a value X will always be the same.
- The probability of many values having the same hash value is negligible.
- It is impossible to find the original text from the hash itself.
The above three properties make a good hashing algorithm and MD#5 is currently the industries most preferred algorithm.
Storing passwords using MD#5
At the time of creating a new user in your database, allow the user to enter a password in plan text. When you fill your database with the information convert the password into a “hash” and store the hash instead of the password.
Remember that the hash is irriversible so you cannot convert the hash back into the original password. But then how will you authenticate the user the next time he/she tries to log in ?
You will need to utilize the 1st property of a hash.
“Hash of a value X will always be the same”
Calculate the hash of the password that the user enters while trying to login and compare the newly generated hash with the stored hash to find out if the two match. If they do, you should welcome the user!
Using MD#5 in PHP to store passwords
The MD#5 of a string can be generated in PHP as easily as
$hash =md5($txtRawPassword);
At the time of user registration, store the $hash into the database. Post that whenever the user tries to log in, using password $pwd, retreive the hash from the database and compare it with the md5($pwd).
if (!strcmp($hash,md4($pwd)))
{
//welcome user!
}
else
{
//send user back to login page.
}
Disadvantage of storing passwords as hash
If the user forgets his/her password, you will not be able to find the original password. Instead, you will need to create a new password for them a mail it to them at their email ID. Isn’t this what google and yahoo does ?