<?xml version="1.0"?>
<rss version="2.0">
  <channel>
    <title>PHPDeveloper.org</title>
    <link>http://www.phpdeveloper.org</link>
    <description>Up-to-the Minute PHP News, views and community</description>
    <language>en-us</language>
    <pubDate>Thu, 23 May 2013 18:47:40 -0500</pubDate>
    <ttl>30</ttl>
    <item>
      <title><![CDATA[Shay Ben Moshe's Blog: Hashing Passwords Properly]]></title>
      <guid>http://www.phpdeveloper.org/news/16335</guid>
      <link>http://www.phpdeveloper.org/news/16335</link>
      <description><![CDATA[<p>
<i>Shay Ben Moshe</i> has a new post to his blog looking at a method he's come up with for <a href="http://blog.shay.co/hashing-passwords-properly/">hashing passwords the proper way</a> and saving them to a database for future checking. His encryption methods of choice <a href="http://php.net/crypt">crypt</a> and a random salt generator.
</p>
<blockquote>
The easy and common solution for this particular problem is to use an one-way hash function, such as md5 and sha1, which takes the password and encrypts it.
Unfortunately, this method is not as strong as you may think. [...] We can protect our password from rainbow tables and similar attacks by using salts.
</blockquote>
<p>
He talks about storing passwords in a database (never as plain text!) and what rainbow tables are and how they can make it simple for a user to break a poorly hashed value. He shows how to use the <a href="http://php.net/crypt">crypt</a> function together with the sha512 hashing tool to make a salt.
</p>]]></description>
      <pubDate>Fri, 13 May 2011 08:47:42 -0500</pubDate>
    </item>
  </channel>
</rss>
