Passwords, md5s, salts

[orban]

Hi there

I have set up two users with the same password.

Then I compare the two users in MySQL with
[...] md5(CONCAT(password, salt)) [...] FROM user [...]

The two strings are NOT the same. I don't get it, I really don't understand it. The JavaScript function somehow returns another value than PHP's md5().

In functions_login.php: verify_authentication(): $md5password is NOT md5($password). This is driving me crazy.

-orban

[Andreas]

The salt is different for each User
The value stored in the Database in Colum password of Table user is md5(md5('PlaintextPassword'), salt) - so this will be different for each user, even if they have the same Password (that's the sense of the Salt).

The value transmitted by the Client (generated with JS) is md5('PlaintextPassword')

[orban]

Ahhhhhhhhhhhhhhhhhhhhhhhhhrg. I thought the field password stored md5($plaintext) and not md5(md5($plaintext).salt). Sorry. :redface:

So there is no method to check if two passwords because the salt was added for exactly that reason.

-orban

[Andreas]

Yep.

[jugo]

Trying to hack vb??? LOL...j/k.

I heard some kid in china developed an MD5 Decryption tool....

[orban]

*g* No.

THere was a script from vB 2 that selected users that have same password to detect double accounts...and I tried to make it work :P

-orban