MySQL password storage/ retrieval

[dmmh]

so, after reviewing my site on security and such, I decided also to look at the way passwords are stored in the current site's form.

I've noticed there are numurous ways to store passwords via built-in MySQL functions such as DES_ENCRYPT(), DES_DECRYPT(), SHA()/SHA1(), AES_ENCRYPT() and AES_DECRYPT().

I am wondering what people here are generally using and why?

I can think of some reasons to choose one over the other:
- SHA() won't let you decrypt the password, so you can not decrypt it and send it in a email when a user has requested it via the site's password request form
- AES_ENCRYPT() and DES_ENCRYPT() are more secure, the first the most, but also more cumbersome

what do people go for? do you just use SHA() and upon password request, only generate a random string, email it as the new password to the user and enter in the DB encrypted with SHA() or do you allow the user to change retrieve his/ her password via email and have the added benefit of extra security of the 2 latter MySQL functions?

and why why why? :)

Would love to see some thoughts on this, after all, it's 'only' a password, not a creditcard nr, so in my opinion SHA() should prove secure enough, but has downsides

[coopster]

A quick search over the forum turns up quite a bit of reading on Encrypting passwords with mySQL/PHP [webmasterworld.com].

[dmmh]

I thought the search fucntion didnt work like it has never worked so I didnt bother to use it tbh ;)

thx

[dmmh]

still doesnt quite give me an idea what most people use though and why.

beside the fact half of the code there is prone to sql injection, there are some nice example.

I would just like multiple opinions, in that thread I mainly see jatar_k's opinion :)

cmon ppl, discuss!

security is also a very issue for me as I will be working with money, from subscriptions, something else far more prone to hacking and a shopping section in the future

[coopster]

Have you considered an md5 hash? MySQL and PHP work together nicely using md5.

[dmmh]

md5 isnt decryptable either, like SHA()
I dont know for sure what I should use and why.
I think a simple password reset form would be the easiest. No need to query for old password, only generate a new one and UPDATE the field

If I would make the switch, I think I would go for the MySQL AES_ENCRYPT fucntion which provides the most security

[jatar_k]

>> in that thread I mainly see jatar_k's opinion

thats' cause I am loud, big mouth and all that ;)

>> as I will be working with money...

that's what I was doing for almost 3 years

there are a bunch of posts where I prattle on about securing passwords and taking necessary precautions.

One way encryption is the way to go, gen a new one if they forget it. Part of the sense in that is to make sure not even you or your employees can read their password.

md5 is well supported and hard enough to crack, I think I read that someone did it or is coming close, can't remember. It is really the most common at this point.

[dmmh]

now thats something I can use :)

[dmmh]

pardon me my remark before about SQL injection before, it was basically directed at you.
I know after this conference you went to recently you posted about how you regretted posting insecure code on this forum so it isnt a flame or something, but there are just too many people who will simply copy the code and use it 1:1
We should all help them as good as possible and as detailed as possible imo

adding a mysql_real_escape_string() for safety's sake is 5 seconds work
just my 0.02, hope you dont/ dint mind

[jatar_k]

I knew it was directed at me and that's fine, you're right

with the size of that post to begin with I was hard pressed to get it all in, hence my adding the link to the review in the same post later.

>> We should all help them as good as possible and as detailed as possible imo

agreed

it is difficult any time i post anything really. For any of us the code we produce is based on our experience and there is no way I can give 5 yrs+ of experience in every post.

we do our best

and I seldom take any issue with people criticizing my code :)

[dmmh]

ok :)

escaping user input was something I had to do in 300 files or so when I discovered the book I bought which should teach me PHP largely neglected it
kinda sucks to have to update all those files later on

[dmmh]

I went for SHA1()

:)