Question

I have some doubts about the best way to do a database with passwords. I need encryption in the passwords, but if i use MD5 i can’t recover the pass, isn’t it?

And the base64 encoder ? it is secure? with this encryption the recover isn’t more a problem.

Suggestions? what is the best way? e prefer a solution that permit to remember the old pass, and not define a new one password.

Thanks!!!

If anybody know a good tutorial about secure passwords in a database i really appreciate that

Answer 1

MD5 is not used for encryption (which implies that it can be decrypted) but rather for message digestion/hashing. Base64 is also not encryption but rather encoding, which can be decoded with no effort.

There is usually little point in storing encrypted passwords in a database if they can be easily decrypted.

The secure approach is to store only hashes and compare submitted passwords to stored hashes after hashing them on the fly.

You should be doing something along the lines of:

$salt = 'some2%string!!here1';
$hash = sha1( $salt . $_POST['password'] );

to create a hash of the password. You store that hash in the database. When a user wants to log in, you take his submitted function, hash it using the same process, and compare to the hash in the database. If they match, the password is correct.