login securities

JackOfBlades

hi does anyone know here what's the most effective login style is? u see im still a noob to php and as far as i know the safest is hasing(md5) the password in the database but the thing is if u forget ur password you cant retrieve it's original form...i was wondering what advance php users would use in logins i hope you guys can share..thanks

NogDog

I use the hashing method. If users forget their passwords, then I generate a new one and email it to them (at which point they can log in and then reset the password to whatever they'd like to use). I typically use the MySQL password() function to do the hashing when using that DBMS for the user data, instead of doing it via PHP's md5() function (no special security advantage, I just started doing it that way at one point with the rationalization that it keeps the hashing method independent of the application program in case I want to use the DB with other programming languages, for instance).

laserlight

I typically use the MySQL password() function to do the hashing when using that DBMS for the user data, instead of doing it via PHP's md5() function (no special security advantage, I just started doing it that way at one point with the rationalization that it keeps the hashing method independent of the application program in case I want to use the DB with other programming languages, for instance).

The way I see it, other programming languages should have their own implementations of MD5, so I do not think using MySQL's password() function provides any advantage, especially since MD5 is standardised.

NogDog

laserlight wrote:
The way I see it, other programming languages should have their own implementations of MD5, so I do not think using MySQL's password() function provides any advantage, especially since MD5 is standardised.

I suspect you're right. I really do it mainly out of habit rather than any rational reason. 🙂

JackOfBlades

how about the ones they use in yahoo? they are known to be secure but im sure they dont use hashing since u can easily retrieve ur password...any ideas? 😃