PHP / SQL: Un-md5 string
Possible duplicate:
Is it possible to decrypt md5 hashes?
I have a database to store usernames, passwords, emails, etc. If the user forgets their password, I will send it to my email account.
The problem is I am encrypting the password for md5 before storing it in my database. If the user's password is ABC, I store it in my database as 867dbd57e9ca9f808. I cannot send user "867dbd57e9ca9f808" if they forget their password. I will need to send "ABC". However, this would require me to have an "un-md5" line, which I think is not possible.
source to share
MD5 was designed as a hash, which is the only way, otherwise it won't be a hash. You do not have to send your password to the user, but you can change it. You must create a token, send a link to change the password to the user's mail with the token in the GET parameter. If the user changes the password, remove the token. Also, you must remember that the token must have an expiration time.
Something like:
myurl.com/passwordrecovery?token=someGeneratedToken
In the database, you can search for the token and get the user ID. So, for example, your table structure might look like this:
user_id | token | expiry_time
If you've only saved tokens and expiration times in the database, then don't do this . Associate a token with a user , otherwise the user can request a change of password and he will receive the following link (do not do this):
myurl.com/passwordrecovery?token=token&user_id=number
Thus, he can change another user's password by replacing user_id. And access his account. The expiration time must not exceed 24 hours.
Attention!
Don't use simple md5, it's easy to hack. Use pbkdf2
for example.
The implementation of the PHP:
PHP-Crypt-Lib
,
Pbkdf2 by inanimatt
source to share
MD5 is not encryption, it is hashing. This means that it is irreversible. You cannot get the original string from the hash.
As for your situation: do as most sites do today. Instead of sending you their password, they send you a link that you can use to reset your password . This way, you don't have to store a text password and send it via email.
source to share
MD5 is not an encryption algorithm .
This is a hashing algorithm. What he produces is not an encrypted form of his input; this is a hash.
Hashing is a one-way transformation. There is a concept in mathematics that we call the Dove Principle. If you have ten birds and nine cubes to keep them in, then it should have multiple cubes with more than one bird. Likewise, if you have passwords 50 in length and all your hashes are 20 in length, there should be multiple passwords with the same hash - far more pigeons than holes!
Since there are many (infinitely many) passwords with the same hash, even a brute-force guessing method cannot recover the original password from the hash (although it can find some password that has a specific hash without knowing for sure it was the one that gave user). The original information is lost .
However, you don't need to send your passwords to users. DO NOT SEND THEIR PASSWORD . The only exception is when the user has to reset their password; in that case create a new temporary password / token for them and give it to them. Then force them to set a new password immediately upon login. Ideally, you would use a secure communication device to do this (for example, an SSL connection to your site) rather than an insecure email.
You don't care what the user's password is, just that they know it.
source to share
The whole point of hashing a string is to make it very hard to get the real password back.
By the way, to increase the security of your database, you should "salt" the password hash, since only MD5 password hashing allows someone with hashes to easily retrieve passwords using a rainbow table.
If the user has forgotten their password, send them a link to create a new password. NEVER send your password by email, which is highly insecure.
source to share
Here's an example that MD5 does:
Suppose you want "md5" the word "bar"
Suppose now that md5 takes each letter in the string, assigns a value to each one, and sums all the numbers you get.
b assigned 2 (second letter of the alphabet ...)
a assigned 1 r assigned value 18
The sum is 21.
You cannot get the reverse value because with my dummy function md5, "arb", "rab", "ggg" gives 21 as well.
This is the reason md5 is unidirectional.
source to share