[SOLVED] MD5 HASHES are not so secure...

[Xeoncross]

After starting down the road of making hashes from all my passwords - I found myself wondering if even that was enough.

 

Thanks to google (and articles like http://alan.blog-city.com/cracking_mysqls_md5_function__within_seconds.htm) I now wonder if there is any better solution to the default "use md5()" model of securing sites. After all, I must admit that the idea of anyone having a http://md5.rednoize.com/ scares me. 

 

Now, one thing I thought of was adding UNCOMMON chars like anything not in [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ] to my hashes to make most rainbow tables (anything < 64GB) useless for my hashes.

 

So, is that a good idea or should I look for something else like SHA-1?

 

P.S. If you don't know what a rainbow table is, please don't respond.

No offense, but I am only interested in seasoned programmers answers.

 

[peranha]

Yes, you should always add something to the password before storing it in the database.  Look at implementing a salt to the password.

 

$salt = anything

 

$passwrdhash = $password.$salt

 

Something like this is more affective.

[PFMaBiSmAd]

Edit: basically says the same as above, with an explanation of why it is effective -

 

If you salt the entered value by prepending or appending a nonsense string (look up salting a hash), then perform the hash, then none of the table lookups will give a value that can be entered to match your hashes.

 

$my_salted_hash = md5("entered value" . "my 89dn nonsense caerd salt a9in string");

 

If someone obtains you hashes and happens to find a value that produces the same hash, when they try that value on your web site, it won't produce the same hash because of the salt string. As long as you never echo or publish your salt string and someone does not gain access to your php code, no one can come up with an original value that will work on your site.

[Xeoncross]

If someone obtains you hashes and happens to find a value that produces the same hash, when they try that value on your web site, it won't produce the same hash because of the salt string. As long as you never echo or publish your salt string and someone does not gain access to your php code, no one can come up with an original value that will work on your site.

 

I did think about using a salt - however, I plan on publishing the code so I thought it would be useless to hard-code something in (like "*^%&#(%"). Never-the-less, I guess I could have the user that downloads my system make his own 10char string and that way each person using my system would have a different hash that other users wouldn't know.

[dbo]

why not just use something like:

 

$salt = $username . "_" . $password . "_" . $username;

 

You've already got a salt... No need to make the users enter anything additional. All you are trying to do is create a hash that isn't stored in a database. Throw on some policy that locks an account for 3 minutes after 3 failed attempts in x amount of time and you'll have a pretty secure system (as far as most applications are concerned).

[Xeoncross]

Your absolutely right. 

 

By using the username (or substr) as a salt you instantly have a system way stronger than one global hash. Just throw in a captcha...

[Daniel0]

If you have PHP 5 (which you should!) then you can also use the hash() function which supports more algorithms like sha256, sha512, ripemd256, etc.

 

 

 

edit: fixed link