Generally speaking it is a really bad idea to hold passwords in cleartext. I am actually amazed people still do this! The standard way of holding passwords that has been around for years is to encrypt or hash the password and store the result, called a ciphertext. There have been many ways of hashing the password, starting off with plain old crypt with no salt (a random pair of characters) then crypt with salt through to MD5 and SHA.
The thing is, each one of these hashing techniques results in a ciphertext in a different length. Now with most languages, this doesn’t matter because you know what hash you are using; its simply the name of the function or some flag you set.
PHP is different, because all of these methods use the one function called crypt which is a little confusing because it is more than plain old crypt. Around the PHP version 5.3 the developers started putting in the more complex hash algorithms which is good, but the ciphertext has been growing.
A lot of applications store this hashed password in a database and the decision needs to be made; how big should this field be? For a long while, 50 characters would be enough and this is what programs like JFFNMS use. Unfortunately the SHA-512 algorithm needs 98 characters so what you get is half a hash stored. When the user enters their password, the program compares the full hash from that password to the half hash in the database and it always fails.
I’ve adjusted JFFNMS to use 200 character long fields which is fine for now. The problem is who knows what the future will bring?
Related articles
- France to require cleartext password storage (boingboing.net)
- Are You Sure SHA-1+Salt Is Enough For Passwords? (it.slashdot.org)
- What All This MD5 Hash Stuff Actually Means [Technology Explained] (makeuseof.com)
- Serious Security Flaw in Amazon.com Passwords (techie-buzz.com)
