Chockstone Forum

      Sponsored By
      ROCK
   HARDWARE

Chockstone Photography

Australian Landscape Prints

Chockstone Forum - Chockstone Feedback

Provide Feedback About This Website

Topic Date User

ummm hacked??? 19-Dec-2006 At 8:18:02 PM PensionerPower

Message

On 19/12/2006 rolsen wrote:
>On 18/12/2006 PensionerPower wrote:
>>On 18/12/2006 rolsen wrote:
>>>Mike how do you store our passwords? Are they encrypted and if so what
>>>method do you use? Just wondering for those who may use the same passwords
>>>over multiple sites, given that someone may have had access to email
>> >addresses and passwords.
>>
>>Passwords should never be "encrypted" (using that word in its technical
>>sense). They should always be "salted and hashed". Identical passwords
>>will normally have different "salted and hashed" values - even on a single
>>site.
>
>Good one. I'm not an expert on this stuff (as I guess you were trying
>to point out) but I've heard a little about rainbow tables and what not
>and know a site compromise is a bad thing. If a hacker can update a table
>surely a select aint that hard?
>
>I was just asking nicely if the passwords were stored in plain text, if
>so the hacker could have everyones passwords and email addresses. If people
>use the same passwords at other sites then this could pose a big problem
>(of course you know this).

I wasn't trying to have a go at you. I was just saying that the question: "are the passwords encrypted", is not the right question. Indeed, if the forum admin replied "yes", that would be bad - not good!

Hopefully the forum admins will understand that passwords should be salted & hashed - not encrypted. But if they don't understand that, then, my reply will hopefully cause them to google those terms for more information.