Building Browsergames - Latest Comments in Building Browsergames: Securing our hashes (PHP)

Re: Building Browsergames: Securing our hashes (PHP)

ValerioDeCamillis — Wed, 24 Aug 2011 12:44:49 -0000

Well, this post is 2 years old now, but still for those reading it now: this is not the proper way of storing salted hashes.

The real purpose of salt is to render hashes of the same password different from each other so that if two users have the same password their hashed values would still look different.

A proper implementation would add a random salt generated on the fly for each user, and store that value in a 'salt' column in the db.

Then you can compute the proper hash fetching the salt associated with the username, then joining it with the password the user typed in.

Disqus is too laggy today for me to write proper code, but i doubt anyone will be reading this anyway.

Re: Building Browsergames: Securing our hashes (PHP)

MrLollige — Sat, 14 Mar 2009 14:05:48 -0000

Ah ok :).
Anyway, my salt (which I made before I read this thanks to the user comments on other pages) is short, and I probably do not need it anywhere else than on the login and register page.
Thanks for your reply!

Re: Building Browsergames: Securing our hashes (PHP)

Luke — Sat, 14 Mar 2009 13:12:13 -0000

The benefits of turning it into a configuration value aren't so much in
securing it, as they are in not repeating it everywhere - if your salt is
'thequickbrownfoxjumpedoverthelazydog', do you really want to type that
everytime you need it?

Re: Building Browsergames: Securing our hashes (PHP)

MrLollige — Sat, 14 Mar 2009 12:13:10 -0000

you could(and probably should) turn the salt into a configuration parameter

Why? I mean, if I change the salt value (if someone figured it and modified his dictionary to it), noone would be able to login any more....

Re: Building Browsergames: Securing our hashes (PHP)

Chris Hepner — Sun, 30 Nov 2008 19:08:12 -0000

It doesn't matter much, but it isn't necessary to nest the md5() function within mysql_real_escape_string() as you will never have to escape a hexadecimal string.

While it usually works regardless, HTTP/1.1 requires you to use an absolute URL in header redirects. Example from php manual below:

/* Redirect to a different page in the current directory that was requested */
$host = $_SERVER['HTTP_HOST'];
$uri = rtrim(dirname($_SERVER['PHP_SELF']), '/\\');
$extra = 'mypage.php';
header("Location: http://$host$uri/$extra");
exit();