I read on PHP.net that MD5 is useless and they suggest using crypt + salt.
So, I went to the description of their functions and read
<?php
$password = crypt('mypassword');
if (crypt($user_input, $password) == $password) {
echo "Password verified!";
}
?>
or in my case something like:
$stored_password=fetch_password($user);
if (crypt($_REQUEST['password'],$stored_password)===$stored_password) {
// ok
}
So, when I see that the salt is stored in a hashed password and that you use this hashed password as a salt, I think that Crypt + Salt is no more secure against brute force output (hackers who managed to steal the hashed passwords). Is it safer?
Against a dictionary attack, I can understand its strength, but for a brute force attack on hashed passwords, I see no advantage.
source
share