Encypting passwords in MySQL with MD5

[kirchie]

Is this as simple as sticking MD5 in front of the user's password when they submit the form (INSERT INTO tblUsers userID=1 userName=Kirchie userPassword=md5(Password) ) or as I suspect is there more to it than that? I'm trying to set up a simple CRM for a website, but with all the hackings going on its got me thinking.

[ChrisMiles]

MD5 is broken, don't use it for passwords its not secure enough these days, you can use AES instead, but you should also salt the password using the username or some other known information.

 

However if you care at all about security you should not encrypt passwords like this because in most scenarios this would mean the password being passed to your database in plain text and may even be logged in plain text. Assuming that you will use SSL to encrypt traffic between the clients and your server you should encrypt the password at the web server point and not pass the information onto a secondary service unencrypted.

[Arthur]

Some of these links may help?

 

• Storing Passwords Securely (via HN)
  
• How To Safely Store A Password
  
• Insecure Cryptographic Storage
  
• Speed Hashing « Coding Horror
  

Use bcrypt or PBKDF2 exclusively to hash anything you need to be secure. These new hashes were specifically designed to be difficult to implement on GPUs. Do not use any other form of hash. Almost every other popular hashing scheme is vulnerable to brute forcing by arrays of commodity GPUs, which only get faster and more parallel and easier to program for every year.

[kirchie]

Cheers guys, that's some good reading there! There's not going to be anything that desperately needs securing in the DB, just the results from some races and some news stories, but if it where to get compromised obviously that would be quite bad. What I'm really looking for is an idiot's guide of how to set it up in the first place. Could you recommend a good guide? I've tried doing a Google search, but the problem is people on forums (present company excluded obviously!) tend to assume that you know it all already. I have a fairly good grounding in PHP, that's about it.

[webman]

If you're storing passwords using PHP, you could do far worse than using phpass.

[kirchie]

If you're storing passwords using PHP, you could do far worse than using phpass.

 

That looks quite good, cheers webman