Question

Possible Duplicate:
Secure hash and salt for PHP passwords

I saw someone coding a password hash like this,

md5(uniqid(mt_rand('password', 15), true));

is that a secured way to do this? is that even worked out?

Answer 1

Not only is that not secure, it doesn’t even work.

mt_rand takes 2 parameters, a min value and a max value.

mt_rand('password', 15)

This converts 'password' to an int (0), then returns a random number between 0 and 15.

uniqid(mt_rand('password', 15), true)

This then generates a unique ID, and prepends the random number from the previous step to it: calculating something like this:

144ffb22886d58e1.82100749

That string is then md5’d.

As you may be able to see, this code is 100% useless. The original password is converted to 0 and lost forever, so all you’re doing is hashing random numbers, which is pointless. Now that you have your hash, there is no way to verify it again. Since the password is converted, whatever the user enters doesn’t matter.

So, no, this code is not secure, do not use it.

Personally, I use the phpass library. It’s secure, and simple to use.