Why does this generate errors?
Md5(crypt(base64_encode($password)))
Quote from: hismajesty on December 22, 2003, 09:28 PM
Why does this generate errors?
Md5(crypt(base64_encode($password)))
I hope you're kidding.
Quote from: Spht on December 22, 2003, 09:32 PM
Quote from: hismajesty on December 22, 2003, 09:28 PM
Why does this generate errors?
Md5(crypt(base64_encode($password)))
I hope you're kidding.
Sadly I'm not...I don't understand why encrypting something three ways would generate an error...
(It doesn't help that I'm just learning php either)
Quote from: hismajesty on December 22, 2003, 09:36 PM
Quote from: Spht on December 22, 2003, 09:32 PM
Quote from: hismajesty on December 22, 2003, 09:28 PM
Why does this generate errors?
Md5(crypt(base64_encode($password)))
I hope you're kidding.
Sadly I'm not...I don't understand why encrypting something three ways would generate an error...
(It doesn't help that I'm just learning php either)
I don't know PHP. But that's like saying
MyReturn = MyFunction(DoesThis(AndThis(ToThis)))
Why doesn't this work???You may need to post your Md5, crypt, base64_encode functions which could be buggy and causing the error.
Those functions are all built into PHP. I guess I'll just do Md5($password) instead, I was just thinking that it being encrypted three times would make it more secure and what not.
Quote from: hismajesty on December 22, 2003, 09:42 PM
Those functions are all built into PHP. I guess I'll just do Md5($password) instead, I was just thinking that it being encrypted three times would make it more secure and what not.
That works? Try:
base64_encode($password)
crypt($password)
Md5($password)
Ugh@spht
If you're looking for one-way encryption, pretty much the best you can get is double-SHA, that is, SHA the data once, then append a "session key" (if applicable) and hash again. If there are no such session keys, one time will suffice.
hrm.
<FORM>
<INPUT TYPE=TEXT NAME=code VALUE="<?echo $code?>">
<INPUT TYPE=SUBMIT NAME=action VALUE="Encode">
<INPUT TYPE=SUBMIT NAME=action VALUE="Decode">
</FORM><BR>
<?
if($action == "Encode") {
echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
echo base64_encode($code);
} elseif($action == "Decode") {
echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
echo base64_decode($code);
}
?>
Hash(Base64 of password) and Hash(Plaintext password) are equally secure. If all you're going to do is calculate a hash, encoding as base64 is unnecessary. See also St0rm's post.
Base64 by itself offers zero security. Its purpose is not security. Its purpose is to encode any data to a form that contains only printable characters, with an overhead of only 33% (as opposed to, for example, an overhead of 100% with encoding as Hex).
Project, that was a pointless. We've already established that base64 was pointless; thus, the reason that I wasn't satisfied using just base64. Base64 is easily decoded with the base64_decode function of php; thus, it's a pointless form of encrypting. Anyways, I just decided to do MD5 hashing only.
Quote from: ProjecT on December 25, 2003, 11:59 AM
hrm.
<FORM>
<INPUT TYPE=TEXT NAME=code VALUE="<?echo $code?>">
<INPUT TYPE=SUBMIT NAME=action VALUE="Encode">
<INPUT TYPE=SUBMIT NAME=action VALUE="Decode">
</FORM><BR>
<?
if($action == "Encode") {
echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
echo base64_encode($code);
} elseif($action == "Decode") {
echo "<B><FONT FACE=Arial>Output:</FONT></B><BR>";
echo base64_decode($code);
}
?>
Looks like a Visual Basic programmer.
Uhhh sorry if it was to late... i just said my idea...
and Crazy a little Vb, cant do a nice work like you or other people, i still need to learn :o.
And Shadowed is teaching me php, heh, he is a god, he made Psi Ops.
What are you trying to do exactly? If you're saving a password as a cookie or something, remember that in most cases, obtaining the hash of a password is equally as useful as obtaining the password itsself.
Hashing != Insta-secure.
Quote from: Spht on December 22, 2003, 09:40 PM
MyReturn = MyFunction(DoesThis(AndThis(ToThis)))
Why doesn't this work???
ROFL ;D
Quote from: Arta[vL] on December 27, 2003, 05:04 PMWhat are you trying to do exactly? If you're saving a password as a cookie or something, remember that in most cases, obtaining the hash of a password is equally as useful as obtaining the password itsself.
Hashing != Insta-secure.
This depends in part on who he's trying to protect against. If he's dubious about who else might be reading through the stored data, hashing the password server side is good enough if the intruder can only read saved data (cannot listen to your chat with the client). Failure to do this is what got Trance (in part, anyway): the passwords were stored cleartext, and a malicious individual had read access to the password storage medium. If the passwords had been stored as a hash, it would have taken at least a little bit of work for the attacker to determine Trance's password in cleartext form.
If the hash is computed client side, then, as you say, obtaining the hash is as good as having the password - for purposes of impersonating the user. However, even in this case, having the hash of the password would not immediately grant knowledge of the user's cleartext password, so you could
only impersonate him/her in this one location.
In my opinion, a good compromise between effort and security is to take the approach Blizzard uses -- a two layer hashing of the password, with the server remembering the one-pass hash and recomputing the two-pass hash from the stored data + the challenge/response cookies.
Quote from: Kp on December 27, 2003, 07:00 PM
This depends in part on who he's trying to protect against. If he's dubious about who else might be reading through the stored data, hashing the password server side is good enough if the intruder can only read saved data (cannot listen to your chat with the client). Failure to do this is what got Trance (in part, anyway): the passwords were stored cleartext, and a malicious individual had read access to the password storage medium. If the passwords had been stored as a hash, it would have taken at least a little bit of work for the attacker to determine Trance's password in cleartext form.
If the hash is computed client side, then, as you say, obtaining the hash is as good as having the password - for purposes of impersonating the user. However, even in this case, having the hash of the password would not immediately grant knowledge of the user's cleartext password, so you could only impersonate him/her in this one location.
In my opinion, a good compromise between effort and security is to take the approach Blizzard uses -- a two layer hashing of the password, with the server remembering the one-pass hash and recomputing the two-pass hash from the stored data + the challenge/response cookies.
How are the BotNet accounts & passwords saved?
Quote from: UserLoser. on December 27, 2003, 08:36 PMHow are the BotNet accounts & passwords saved?
They're still saved however Skywing had them configured to be saved. I haven't even touched his account modification functions (there's been no need).
storedhash = read();
randomvalue1 = read();
password = recv();
hash = md5(password + randomvalue1);
for(i = 0; i < 1000000; i++)
hash = md5(hash + randomvalue1);
if(storedhash == hash)
success();
Very secure!
Quote from: Adron on January 03, 2004, 05:42 PM
storedhash = read();
randomvalue1 = read();
password = recv();
hash = md5(password + randomvalue1);
for(i = 0; i < 1000000; i++)
hash = md5(hash + randomvalue1);
if(storedhash == hash)
success();
Very secure!
Is there any language/scripting you
don't know? :P
Quote from: UserLoser. on January 03, 2004, 06:37 PM
Quote from: Adron on January 03, 2004, 05:42 PM
storedhash = read();
randomvalue1 = read();
password = recv();
hash = md5(password + randomvalue1);
for(i = 0; i < 1000000; i++)
hash = md5(hash + randomvalue1);
if(storedhash == hash)
success();
Very secure!
Is there any language/scripting you don't know? :P
That's probably not valid php btw... I've only done very little php scripting, and this was more like pseudocode. I was just suggesting that he hash it one million times for improved security.
He missed an end if.
[edit]and an end for[/edit]
Quote from: j0k3r on January 03, 2004, 09:31 PM
He missed an end if.
[edit]and an end for[/edit]
He did?
Adron's code is fun.
It's not the code that matters, it's the idea it tries to convey.
Quote from: Adron on January 07, 2004, 04:14 PM
It's not the code that matters, it's the idea it tries to convey.
That's why it's fun :)
Quote from: j0k3r on January 03, 2004, 09:31 PM
He missed an end if.
[edit]and an end for[/edit]
Actually, if you want to get technical, in PHP, if you are only doing 1 thing in an if/for statement the { } are not required, therefore..
if($blah)
do_soemthing();
or
for($i = 0; $i > 10; $i++)
do_something();
is just fine..