Question

I am making a simple web-app which requires login for the admin page. I came across this incantation on the web.py site (http://webpy.org/cookbook/userauth) :

import hashlib
import web    

def POST(self):
    i = web.input()

    authdb = sqlite3.connect('users.db')
    pwdhash = hashlib.md5(i.password).hexdigest()
    check = authdb.execute('select * from users where username=? and password=?', (i.username, pwdhash))
    if check: 
        session.loggedin = True
        session.username = i.username
        raise web.seeother('/results')   
    else: return render.base("Those login details don't work.")

However the page also gives a somewhat ominous warning: “Do not use this code on real site – this is only for illustration.”. I was wondering if there are any major holes in this, I’m somewhat unfamiliar with web-programming so just wanted to make sure that using this code wont unwittingly make the app open to trivial attack vectors?

Many thanks

Answer 1

The only possible problem I can think of here, could be if it would somehow be possible to exploit MD5 collisions, i.e. that two different strings can generate the same MD5 hash – in that case someone could potentially log in with a password that is not correct, but generates the same MD5 hash.

Changing to a better hashing algorithm such as SHA-1 (or something else available in hashlib) would close this potential security problem.

As far as I know, it would be very difficult to exploit the MD5 collision problem to gain access. Even so, it is broken, and quoting security guru Bruce Schneier from the wikipedia article:

[he] wrote of the attack that “[w]e already knew that MD5 is a broken hash function” and that “no one should be using MD5 anymore.”