Seems like NickFitz was right - Telegraph hacked

[OwlHoot]

Someone in their IT department is for the high jump, following an SQL injection exploit.

Story (discussion by the hackers themselves actually) here and another article here.

It's almost unbelievable that anyone these days would neglect to properly encode client-derived strings in SQL statements.

[NickFitz]

Passwords in the database as plain text?

FFS...

[BrilloPad]

They should have employed NickFitz......

[DimPrawn]

Today's headline

A PHP + MySql website in totally unsecure shock horror!

[EternalOptimist]

question for Nick

am I right in saying that the client is used to encrypt/decrypt the pwd, and the result can be stored , say, as a varchar ?


if you can hear a funny noise, it's my @rse hole twisting

[OwlHoot]

question for Nick

am I right in saying that the client is used to encrypt/decrypt the pwd, and the result can be stored , say, as a varchar ?


if you can hear a funny noise, it's my @rse hole twisting

The usual practice is to store only a hash (MD5 or SHA etc) of the password, and compare this with hashes (using the same scheme) of password attempts submitted by the client.

The chance of a hash collision with a different submitted string of reasonable length is so remote it can be ignored.

[BlightyBoy]

The usual practice is to store only a hash (MD5 or SHA etc) of the password, and compare this with hashes (using the same scheme) of password attempts submitted by the client.

Yup. This is exactly how PIN numbers on your Chip & PIN card work. The encrpytion key and encrypted answer are stored on the Chip, but not the actual PIN number.

It's one of those mechanisms whereby you cannot reverse-engineer the "answer" to the "question" even if you have the encryption code.

[EternalOptimist]

Yup. This is exactly how PIN numbers on your Chip & PIN card work. The encrpytion key and encrypted answer are stored on the Chip, but not the actual PIN number.

It's one of those mechanisms whereby you cannot reverse-engineer the "answer" to the "question" even if you have the encryption code.

so what would a hash of 'password' look like, and can i store it in a varchar

(i am building a back end for some app devs- long story)

[DaveB]

so what would a hash of 'password' look like, and can i store it in a varchar

(i am building a back end for some app devs- long story)

An apparently random sequence of alphanumeric characters of variable length but with fixed bounds.

[EternalOptimist]

An apparently random sequence of alphanumeric characters of variable length but with fixed bounds.

merci