-1

I would like to hear if this is safe enough for storing passwords in a mysql DB.

<?php
    $password=hash('sha512',$_POST['password']);
    //and then insert it into and mysql database
?>

Is this safe? If not how could I do it more safe?

karthikr
  • 97,368
  • 26
  • 197
  • 188
user3508356
  • 5
  • 1
  • 5
  • what php version u use? if >=5.5, u can use `password_hash` function – slier Apr 07 '14 at 20:35
  • 2
    Use [bcrypt](http://stackoverflow.com/questions/4795385/how-do-you-use-bcrypt-for-hashing-passwords-in-php) – kojiro Apr 07 '14 at 20:36
  • Using a straight hash isn't safe at all: at the very least, you should be using a salted hash – Mark Baker Apr 07 '14 at 20:37
  • I think its one of the newest since I installed Apache a little month ago. So just $password=password_hash($_POST['password']; ?? – user3508356 Apr 07 '14 at 20:39
  • It's really impossible to answer the questions *safe enough* without specifying *safe enough for what*? Safe enough for [ftp passwords](http://security.stackexchange.com/questions/17319/is-it-worth-the-effort-to-store-ftp-passwords-encrypted)? meh. Safe enough for financial information? hella no. – kojiro Apr 07 '14 at 20:39
  • Its not for storing billion dolor bank accounts but a forum. But I still like it to be safety – user3508356 Apr 07 '14 at 20:41

2 Answers2

0

Basic, straight hashes have not been considered safe for years. md5 has been outright broken for years. Salted hashes have been considered best practice up until maybe 6-8 years ago, but now they are no longer considered safe either.

Please use one of the following methods to encrypt your passwords securely:

  • bcrypt (Google link, because native PHP methods are very new and implementing this will vary depending on your version of PHP) - this would be considered industry standard best practice at the moment
  • pbkdf2 (Google link, for the same reason as above) - this is a slightly different strategy than bcrypt, generally considered weaker but very tunable and may be easier to implement, and should be considered the minimum
  • scrypt (I have not looked into this particular module, but it's the top result on Google) - scrypt has certain features that should make it more secure than bcrypt, but it's missing one crucial element that bcrypt has - a long history of people trying and failing to break it.

The key to all of these functions is that they are designed to run slowly. In particular, where traditional hashing algorithms can be run millions or billions of times a second, allowing an attacker to brute force your passwords in a reasonable amount of time, these functions can be tuned to only run 10 times a second, or twice, or once, or even take several seconds to complete. You would never want to set these algorithms to run in that way, you'd probably want to tune it so it would complete in 1/10 to 3/10 of a second, which would be almost imperceptible to your users, but would still make brute forcing impractical.

Jason
  • 13,606
  • 2
  • 29
  • 40
0

I would suggest using blowfish http://www.php.net/manual/en/function.crypt.php Use a custom generated salt

Mike M.
  • 361
  • 2
  • 14