Encryption in PHP

Reply

Join Date: Apr 2006
Posts: 9
Reputation: RuneMan is an unknown quantity at this point 
Solved Threads: 0
RuneMan RuneMan is offline Offline
Newbie Poster

Encryption in PHP

 
0
  #1
Nov 29th, 2008
I am developing a website which encrypts every user's password with sha1() method and is stored in the database.
Now the problem is I want to offer a recover password function for my users. but i dont know how to get the password from the salted string

Help me!!!
Reply With Quote Quick reply to this message  
Join Date: Oct 2006
Posts: 232
Reputation: Rhyan is an unknown quantity at this point 
Solved Threads: 24
Rhyan's Avatar
Rhyan Rhyan is offline Offline
Posting Whiz in Training

Re: Encryption in PHP

 
0
  #2
Nov 29th, 2008
You can't.
SHA is one-way encoding mechanism. So in order to verify a password, the verification string has to be encoded using the same key as it has been initially encoded upon inserting into the database.

You have to choose another method of encoding, which provides decoding as well.

However, i think that you better provide password recovery either by sending a link to the customer's email where he can follow it and change the password, or generate a random string and send it to the customer in an e-mail as a default password.

The SHA hashing mechanism is secure enough, so i don't suggest you going for change of the encoding mechanism.
" Of all the things I've lost,
I miss my mind the most...."
Mark Twain
Reply With Quote Quick reply to this message  
Join Date: Sep 2005
Posts: 1,075
Reputation: digital-ether is just really nice digital-ether is just really nice digital-ether is just really nice digital-ether is just really nice 
Solved Threads: 66
Moderator
digital-ether's Avatar
digital-ether digital-ether is offline Offline
Veteran Poster

Re: Encryption in PHP

 
0
  #3
Nov 30th, 2008
Originally Posted by RuneMan View Post
I am developing a website which encrypts every user's password with sha1() method and is stored in the database.
Now the problem is I want to offer a recover password function for my users. but i dont know how to get the password from the salted string

Help me!!!
The whole reason you should use SHA-1 for storing passwords is that the original password cannot be retrieved by anyone including your application. So you can't offer a password recovery, only a means to change your password after you have verified that you own the account. (like mentioned above by Rhyan).

Storing passwords in a way that they can be decrypted is useless since you would have to store the key where your application can retrieve it. Thus if your application is compromised, all the passwords will be as good as stored in plain text.
www.fijiwebdesign.com - web design and development and fun
Cpanel Email - Let users Register email accounts on your website upon registration
Ajax Chat - Fully browser based chat!
Reply With Quote Quick reply to this message  
Reply

This thread is more than three months old.
Perhaps start a new thread instead?
Message:



Similar Threads
Other Threads in the PHP Forum
Thread Tools Search this Thread



About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC