Using GetHashCode to "secure" users passwords

Question

The company I work for has taken on a support contract for a large order processing system. As part of the initial system audit I noticed that the passwords stored in the database were actually the hashcode of the password.

Essentially:

string pwd = "some pasword";
string securePwd = pwd.GetHashCode();

My question is, how secure or otherwise is this?

I'm not comfortable with it, but I don't know enough about how GetHashCode works. I would prefer to use something like an MD5 hash, but if I'm wasting my time then I won't bother.

Answer 1

GetHashCode returns a 32 bit integer as the hash value. Considering the birthday paradox, it's not a really acceptable hash value due to the relatively high probability of collisions. You'd probably want to go for SHA1, MD5, SHA2 or something really designed to handle such a task.

Answer 2

You should use a salted, cryptographically strong hash, such as SHA256Managed.

Jeff Attwood has a few good posts on this topic:

Rainbow Hash Cracking

You're Probably Storing Passwords Incorrectly

Answer 3

It's not just insecure, but also subject to change:

http://netrsc.blogspot.com/2008/08/gethashcode-differs-on-systems.html

The value returned by GetHashValue for a given input has changed in the past.

There's no guarantee it will even be the same between different executions of the app.

Answer 4

GetHashCode was definitely not designed to be used in this way as the implementation does not guarantee different hash returns for different objects. This means that potentially multiple passwords could produce the same hash. It also isn't guaranteed to return the same hash value on different versions of the .NET framework meaning that an upgrade could potentially produce a different hash for the same string, rendering your passwords unusable to you.

It is recommended that you use a salted hash or even MD5 at a push. You can easily switch it to something within the Security.Cryptography namespace.

Answer 5

As others have said, GetHashCode isn't designed for what you're trying to do. There is a really excellent article on how to handle user passwords securely.

To summarise the article, you need to use either a relatively slow adaptive hashing scheme such as bcrypt, or alternatively the Stanford Secure Remote Password Protocol. I would suggest the former. And of course you should also use a salt.

Answer 6

I'd recommend using BCrypt instead. As others have already said using GetHashCode for passwords isn't a good idea.