943,565 Members | Top Members by Rank

Ad:
  • PHP Discussion Thread
  • Unsolved
  • Views: 598
  • PHP RSS
Nov 29th, 2008
0

Encryption in PHP

Expand Post »
I am developing a website which encrypts every user's password with sha1() method and is stored in the database.
Now the problem is I want to offer a recover password function for my users. but i dont know how to get the password from the salted string

Help me!!!
Similar Threads
Reputation Points: 10
Solved Threads: 0
Newbie Poster
RuneMan is offline Offline
9 posts
since Apr 2006
Nov 29th, 2008
0

Re: Encryption in PHP

You can't.
SHA is one-way encoding mechanism. So in order to verify a password, the verification string has to be encoded using the same key as it has been initially encoded upon inserting into the database.

You have to choose another method of encoding, which provides decoding as well.

However, i think that you better provide password recovery either by sending a link to the customer's email where he can follow it and change the password, or generate a random string and send it to the customer in an e-mail as a default password.

The SHA hashing mechanism is secure enough, so i don't suggest you going for change of the encoding mechanism.
Reputation Points: 21
Solved Threads: 26
Posting Whiz in Training
Rhyan is offline Offline
240 posts
since Oct 2006
Nov 30th, 2008
0

Re: Encryption in PHP

Click to Expand / Collapse  Quote originally posted by RuneMan ...
I am developing a website which encrypts every user's password with sha1() method and is stored in the database.
Now the problem is I want to offer a recover password function for my users. but i dont know how to get the password from the salted string

Help me!!!
The whole reason you should use SHA-1 for storing passwords is that the original password cannot be retrieved by anyone including your application. So you can't offer a password recovery, only a means to change your password after you have verified that you own the account. (like mentioned above by Rhyan).

Storing passwords in a way that they can be decrypted is useless since you would have to store the key where your application can retrieve it. Thus if your application is compromised, all the passwords will be as good as stored in plain text.
Moderator
Reputation Points: 457
Solved Threads: 101
Nearly a Posting Virtuoso
digital-ether is offline Offline
1,250 posts
since Sep 2005

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in PHP Forum Timeline: blog software
Next Thread in PHP Forum Timeline: PHP Cookies Tutorial





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC