salt, what is it?
 

In the vb3user field, what does salt char(3) represent? :confused:

pepper?

Salt is NaCl...

Whoops, wrong salt? Salt is a few screwed up characters that are used for the password hash to make it more secure. I think it's something like

md5(md5($password) + md5($salt))

It's an additional level of encryption that makes it virtually impossible to reverse an md5 encrypted password.

I believe there's even more to it than that, I think they mix in the userid too?

ok, thanks

Actually, I was slightly wrong.

Close enough, but the salt is only md5's once while the password is md5'd by itself and then again with the salt. :)

Hmm in functions_newpost.php or something I saw some weird line of a loada md5'ing going on including some other stuff :confused:

Looks like they really kept security in mind when making vB3 :eek:

maybe the md5 thing there was for the login on making new posts?

Its the posthash I expect, which is used for attachments amongst other things I suspect.

not entirely on the subject, but is there an easy query to add a vb3phrase instead of using the phrase manager?
I dont like that thing.

Even if you use phpMyAdmin or a query, you'd still have to edit a phrase using the phrase manager to update its cache.

The md5() stuff in functions_newpost.php is just used to make sure you don't double post. It is more robust than using the old query that would compare the post text, title, etc against entries in the database.