hashing

[manix]

Hey,

 

Does it make it harder for someone to bruteforce a string which is hashed multiple times?

 

For an example I have the string 'John' and I do md5(md5($john)) would that be the same as md5($john)

 

Or maybe if I do md5(sha1(md5($john))) ?

 

And also is it able to tell the hashing, which would make this whole post pointless ?

[freelance84]

Hashing the password prevents someone from from seeing the password if they managed to access the database.

 

I dont think it is possible to completely stop a brute force attempt, but you can slow them down with a CAPTCHA:

 

1 The user starts a session when 1st accessing the homepage.

2 Count the number of log in attempts into a session variable or cookie

3 When the count reaches a certain value, tell the user they must now complete a CATPCHA to continue... or anything similar.

[Nodral]

I'd agree with this, however I tend to give them 3 attempts then they must close the browser (ie reset the session variable) and start over.

[manix]

Nah I have a cookie containing a hashed username (if the user chose to stay logged in forever) but if a user can tell what hashing I used and then hash the admin username the same way I hashed the cookie will be able to log in with the admin account

 

example:

database username: philip

cookie's value: sha1(md5(sha1($username)))

then check

if (sha1(md5(sha1($databaseusername)))==$_COOKIE['username']){add user panel etc etc}

 

my point is that a user can see the cookie's value and bruteforce it without using the website at all if they can tell the hashing

[Muddy_Funster]

if your worried about the strenth of your hash, use a stronger encription.  Also, I tend to use a substing lookup on any hashes I use, you could use that to mask what type of algerithem you have used by only selecting certain parts of the hashed string for storage and comparison.

[manix]

erm.. Okay. I just want to know

 

is this: md5(sha1(md5($str))) stronger than this md5($str)

[Muddy_Funster]

yes, but it's over complicating things.  check out the cryp() function if you want to apply something stronger.