Seems like NickFitz was right - Telegraph hacked

[BlightyBoy]

An apparently random sequence of alphanumeric characters of variable length but with fixed bounds.

Actually, that depends...

If you use SHA or MD5, then DaveB is correct. However, I have implemented an encryption algorithm that produces a 32-bit unsigned integral number. This is particularly useful for either a) doing faster numeric, rather than textual comparisons, and b) using the "hashed" value of a alpha-numeric (text) as a key value in a binary search tree.

[EternalOptimist]

An apparently random sequence of alphanumeric characters of variable length but with fixed bounds.

merci

[DaveB]

so what would a hash of 'password' look like, and can i store it in a varchar

(i am building a back end for some app devs- long story)

An apparently random sequence of alphanumeric characters of variable length but with fixed bounds.

[EternalOptimist]

Yup. This is exactly how PIN numbers on your Chip & PIN card work. The encrpytion key and encrypted answer are stored on the Chip, but not the actual PIN number.

It's one of those mechanisms whereby you cannot reverse-engineer the "answer" to the "question" even if you have the encryption code.

so what would a hash of 'password' look like, and can i store it in a varchar

(i am building a back end for some app devs- long story)

[BlightyBoy]

The usual practice is to store only a hash (MD5 or SHA etc) of the password, and compare this with hashes (using the same scheme) of password attempts submitted by the client.

Yup. This is exactly how PIN numbers on your Chip & PIN card work. The encrpytion key and encrypted answer are stored on the Chip, but not the actual PIN number.

It's one of those mechanisms whereby you cannot reverse-engineer the "answer" to the "question" even if you have the encryption code.

[OwlHoot]

question for Nick

am I right in saying that the client is used to encrypt/decrypt the pwd, and the result can be stored , say, as a varchar ?


if you can hear a funny noise, it's my @rse hole twisting

The usual practice is to store only a hash (MD5 or SHA etc) of the password, and compare this with hashes (using the same scheme) of password attempts submitted by the client.

The chance of a hash collision with a different submitted string of reasonable length is so remote it can be ignored.

[EternalOptimist]

question for Nick

am I right in saying that the client is used to encrypt/decrypt the pwd, and the result can be stored , say, as a varchar ?


if you can hear a funny noise, it's my @rse hole twisting

[DimPrawn]

Today's headline

A PHP + MySql website in totally unsecure shock horror!

[BrilloPad]

They should have employed NickFitz......

[NickFitz]

Passwords in the database as plain text?

FFS...

[OwlHoot]

Someone in their IT department is for the high jump, following an SQL injection exploit.

Story (discussion by the hackers themselves actually) here and another article here.

It's almost unbelievable that anyone these days would neglect to properly encode client-derived strings in SQL statements.