How to securely store registration/login information like a password?

Question

I am in the process of resecuring my registration on my website and want to ask if my password hashing is correct. Or if there is any better more secure way I can do it. I read somewhere that the salt can be written to the database on a per user basis.

This is my security so far:

$salt = sha1(md5($activecode).$username);

$username = mysql_real_escape_string($_POST['username']);
$activecode = mysql_real_escape_string(time());
$pass1 = sha1(md5($_POST['pass1'].$salt));
$pass2 = sha1(md5($_POST['pass2'].$salt));

Answer 1

• Don't take the SHA1 of the MD5, use only SHA1.
• http://benlog.com/articles/2008/06/19/dont-hash-secrets/
• http://securecoding.ch/?story=068-don-t-hash-passwords-i-d-say-yeshash-them-but-correctly

Answer 2

Maybe I am missing something, but how would you ever be able to validate a password. You use the current timestamp for a salt which means that at the time you are checking the password, you will get something completely different. Or you you save also the activecode to the database?

If you are doing so, it look fine for me.

Answer 3

your examples is strange. i think line 1 goes after line 4?

you can of course save a dynamic salt keys to the database. but if your md5 gets leaked, it will probably get along with it. so this wouldnt do any good against rainbow tables.

of course you could save a salt key to a seperate database or something, but i dont know how senseful that would be.

whatever you do keep one salt key in your application only.

but far more important things are for example to * secure your login with https, * force your users to use strong passwords * passwords shuold change every lil while * logut after x seconds * provide a remote logout ... stuff like that

also i think double hashing something might lead to problems. dunno exactly why but i dont see much sense in that...

Answer 4

This very code snippet has very little with security. As well as with common sense. What's the use of doing hashes of both passwords? I guess you have to compare entered passwords and then make a hash of just one.

MD5 is really wrong here. Just make it sha1($_POST['pass1'].$salt));

mysql_real_escape tring is a database related function, not form handling one. A right place to use it is right before adding data into query. For the strings going into query enclosed in quotes.

And what Joe have said.