Password Program

It is very important for web designers to protect the passwords with which they are entrusted.

A huge security risk happens when hackers break into a site and steal the user database with all of the passwords. If the passwords are poorly secured, hackers can figure out the preferred user name of a person and their preferred password.

(Many users use the same userName/PassWord combination on all sites. If a hacker cracks one password the hacker can go after accounts on different servers. It is wise to use different passwords for every online account. This is especially true of any account involving money.)

Web programs need to encode passwords in ways that make it difficult for the hacker to reassemble the password.

There are some nice industry standard algorithms that do a good job encoding passwords. But hackers have built massive "rainbow tables" that help them discern encoded passwords.

The standard PHP password is called password_hash() . This program tries to thwart hackers by creating a 60 character hash from the password. The PHP manual says they plan to move to a 72 character string shortly.

Storing 72 characters for a password seems absurd to me.

Since I have a small site. I think it will be better to create my own encoding program. The program does some fancy footwork with primes and bits to create a hash that is difficult to unhash. Here is the basic code used in my program. This second link is a form that tests the hash generator.

The program is still weak on handling multi-byte UTF8 characters and was optimized for passwords from 8 to 16 characters.

The reason that I wrote the program was to say that If we are forced to produce horrendously long password hashes, the password programs should output binary strings and not super long strings of characters.

I will change the value of the primes on my production server and intend to rewrite the program in c, just as soon as I learn to program in c. I need to improve the UTF8 support. Right now it uses each character in a multi-byte character, when I should only look at the last character.

The output is a 16 character binary string which is a bit more manageable than a 72 character string.

Off course, storing passwords in a Pain in the Tush. I've actually started using Oauth for authentication. Of course, that means that when a hacker breaks into a Twitter account the hacker can attack all the sites using OAuth.