Databases
StackOverflow2013
Postsdbo
POUsing blowfish in PHP for storing passwords
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POUsing blowfish in PHP for storing passwords
    primarykey
    data
    text
    <p>This whole cryptology thing is a lot to swallow, but it's really interesting and I've been reading about it lately.</p> <p>My question is about using blowfish to hash your passwords for storage. I know a salt is needed, but I'm not exactly sure what to do for it. I have some questions.</p> <ol> <li><p>Many tutorials I read people just seemingly randomly come up with one like "oidsjf03" and use it for all their salts. Do they just mash their keyboard or what?</p></li> <li><p>I've also read a lot that says each password should have a unique hash. So I generate a separate salt for each password I store. Then I'd have to store that somewhere. Where, however? If I just store it as an entry in the user's row, if the database was compromised could they not just generate rainbow tables with that salt?</p> <p>Would I be correct in saying this isn't viable, as they'd need to generate a rainbow table for every password, and with blowfish creating each hash would take awhile, so this wouldn't be practical?</p></li> <li><p>Why is having a unique one for each user so important? Say you're using blowfish and your database is compromised, and your salt gets captured as well. The hacker could create a rainbow table to test your passwords, but with a good amount of rounds on the hash, it may take 0.1 seconds per password, for instance. If they want to create a rainbow table with 1 billion entries, that's 100 million seconds to create it (or around 3 years).</p> <p>If you used unique salts and had say 1000 passwords, they'd have to create 1000 rainbow tables, increasing the amount of time to 3000 years. Is this why? The amount of time goes up per password stored?</p></li> <li><p>How do you generate this salt for the hash? Is PHP's <code>uniqid()</code> function enough or should I be doing some fancy stuff?</p></li> <li><p>Do I really need to create a full out class et al, or can I create a simple function?</p></li> <li><p>Lastly, I've heard phpass mentioned a lot for its security and how users should just use that instead of potentially making errors themselves. Is this really the recommended practice?</p></li> </ol>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. UShalfer
    1. USDoug Smith
    plurals
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POUsing blowfish in PHP for storing passwords
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POUsing blowfish in PHP for storing passwords
      1. This table or related slice is empty.
      1. VTUpMod
    1. CONot for q&a style
      singulars
      1. POUsing blowfish in PHP for storing passwords
      1. USWilliam N
    2. CORe: #3, the reason salt should be separate per-user is so that if multiple users use the same password ("secret1") they won't have the same hash - an attacker can't tell they're all using the same password, they'll have to crack each one individually. And re: #6, YES. It is a fundamental rule of Security that you're better off using code that someone else wrote and many else's have tested than to do it from scratch and repeat their mistakes.
      singulars
      1. POUsing blowfish in PHP for storing passwords
      1. USgowenfawr
    3. COAnd read http://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
      singulars
      1. POUsing blowfish in PHP for storing passwords
      1. USMichael Berkowski
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload