[SOLVED] Security Question and Answer - store and handle like passwords?

[limitphp]

To set a new password, I'm adding a security question and answer.  Do you think its necessary to store the security answer they give in the database encrypted like passwords?

 

Also, do you think its necessary to handle the security answer on the html form as password type?

<input type=password name=securityAnswer>

 

I'm don't have SSL on my website, and probably won't be able to get it until it gets popular and makes me a little money to pay for it.

 

[keiran420]

Sure, couldn't hurt, the more security mesures added, the better really...

 

Saying that though, i would hope you security question would email the new password to the registerd email address.. thus making the security answer kind of pointless without access to that email....

[premiso]

Very possible, just md5 the security answer. And when they try to use you just have to check against the md5 hash.

 

I usually handle it on the form as a non-password type. Cause the password type is just to prevent people looking over your shoulder from seeing.

 

Just remember it will case sensitive if you use the md5 hash.

[limitphp]

Sure, couldn't hurt, the more security mesures added, the better really...

 

Saying that though, i would hope you security question would email the new password to the registerd email address.. thus making the security answer kind of pointless without access to that email....

 

Yeah. 

Basically, on the frontpage there's a link users can click called "forget password".

 

Once there, they enter in their username.

 

Once a username matches, it takes them to a form for them to fill out their:

fname, lname, email address, (it shows their security question) and their security answer, and a recaptcha.

 

Once they submit that, if all entries match the user table (email included) I will send a reset password to their email address from the user table.

 

So they have to know name, email address and security answer to reset password.

 

The only thing I see about this system is, people can use it to easily see if a username is taken.  I don't know if thats neccessarily a horrible thing, though.

 

 

 

 

[limitphp]

 

Just remember it will case sensitive if you use the md5 hash.

 

Ooooo.......thanks for telling me that!  In that case, i don't think I want to hash it.  If its several words long, they might not remember if they capitalized anything.

[gevans]

Let them do it as they like, but make your string lower case before hashing it.

 

Do that when you add it, and check it;

 

$name = strtolower($name);

 

Or you could just tell them it's case sensitive, they should remember!!

[premiso]

 

Just remember it will case sensitive if you use the md5 hash.

 

Ooooo.......thanks for telling me that!  In that case, i don't think I want to hash it.  If its several words long, they might not remember if they capitalized anything.

 

Or just strtolower all the answers and when they submit it do the same before you hash it and you are good.

[limitphp]

dang you guys are clever!  Nothing ever gets by you guys.....its ridiculous.

 

I'll do that. 

Thanks guys!