September 7, 201016 yr Hi guys, By default i will always use some method to hash the passwords before storing them into a database such as SHA1, MD5 but when it comes to the user forgetting his/her password usualy you would provide a way of resetting the users password and give them an option to enter a new password, but recently some websites i have come across seem to be sending the "current password" in clear text back to the user via email, the question is, are they storing the password in clear text without any hashing, if so, is it secure to do so? Regards Shaun
September 7, 201016 yr Hi guys, By default i will always use some method to hash the passwords before storing them into a database such as SHA1, MD5 but when it comes to the user forgetting his/her password usualy you would provide a way of resetting the users password and give them an option to enter a new password, but recently some websites i have come across seem to be sending the "current password" in clear text back to the user via email, the question is, are they storing the password in clear text without any hashing, if so, is it secure to do so? Regards Shaun I think if u do this on a SSL connection it should be secure
September 7, 201016 yr I wouldn't say its secure however, most websites use SSL just as webdesigner93 pointed out and thus the connection is secure anyway. I would say with a website, you should reset the password on the website and store secret questions answers in base64.
September 7, 201016 yr You can use mcrypt or openssl to encrypt the password, then store the encrypted value in the db then decrypt it on login/forgot password.
September 7, 201016 yr Depends... sending the password in clear text is done on the presumption that the users email account hasn't been compromised... if it is the victim would change their password and the attacker could get the update sent to the victims email... if the website made the attacker change the password then maybe things would of been different as the victim would then be aware that it has happened. all in all though it is not your responsibility to ensure the users email is not compromised, but adding a few loops to jump through will help make social engineering attacks less desirable... EDITS (people post quickly) base64 is an encoding not encryption... its purpose is to ensure the safe transport of data by providing a ASCII text version... for example anyone can decode this... YW5kIG5vdyB5b3Ugc2VlIG1l so base64 provides no security only data integrity. as for password storage, one way hashes are best... being able to find out what a users password is generally is a real bad idea... say for instance one of your staff leaves/gets sacked and steals the users DB, or a hacker compromises the server finding the encryption key in the code and then getting the users DB... how many people do you think use the same password on accounts as they do for their email? Just my 2 cents as they say in the USA Edited September 7, 201016 yr by SniderDK
Create an account or sign in to comment