ansaurus

Question

Answer 1

+5 A:

Then the "hash" would be the password. What would be the benefit?

VolkerK 2009-07-04 19:54:33

So someone, even if they get the plain text connection data, wouldn't know the user's password. Which would only matter if you use the same password on everything.

colithium 2009-07-04 20:01:46

But since you as the cautious developer/admin are already concerned about this you wouldn't use this password also everywhere else ;-) And you have placed it somewhere not accessible through your webserver.

VolkerK 2009-07-04 21:06:59

The benefit would be privacy. I'm developing an application which stores database connection values (in a 'master' database) for using the application.

Stefan 2009-07-05 10:47:30

I don't see the advantage. Let's assume MySQL has such a ...connect_with_passwordhash() function. I somehow get access to your master database and steal all your password hashes. Now, can't I simply feed them the to ...connect_with_passwordhash() like your script does?

VolkerK 2009-07-05 11:23:22

That is true, though when it's THEORICALLY impossible to access the master MySQL database, it gives a user more privacy storing a password hashed. WHEN someone gets access to the master database, what's the point of stealing the password? All other databases (with other users and passwords) also run on the same server, why not copy all stuff immediatly?It's just a privacy issue.. I know it's possible to get access with the plain password OR hash.

Stefan 2009-07-05 13:49:11

But you don't need another built-in mysql function for that. Build an account management system (/a web interface) that takes the plain password and then stores the hash in the "master database" and the other databases (as the password). That would also be a good opportunity to add some kind of password salt.

VolkerK 2009-07-05 14:21:35

Answer 2

A:

The short answer is no.

But, just wondering... what is your real concern? Someone hacking into your server and discovering your password?

Hans 2009-07-05 22:32:06

Just privacy, would you like it when you (for example) sign up on a website without you're password being encrypted in the database?

Stefan 2009-07-09 17:17:03

The reason you should hash (not encryption) peoples passwords is not to protect their data, but to prevent hackers, who already have breached your security and have access to everything, from being able to take you login details and try to reuse it to access your details on other sites, such as email.Just be wary of when you are walking the line between obfuscation and security.

Hans 2009-07-31 16:14:29

ansaurus

tags:

views:

answers:

Connect to MySQL with hashed password?

related questions