md5 security

[Davey]

But the user doesn't see that hash, so they are none the wiser.

Dave.

[Dean C]

But on two different boards... the same passwords would have a different hash?

- miSt

[filburt1]

In vB3, yes, because each vB3 installation has a unique "salt" for generating the hash. In vB2, the salt is the same and your hashed password on one board will be the same as your hashed password on another board, if the two passwords themselves are identical.

[Dean C]

So in fact you could de-crypt md5 like any other code if you took the time?

- miSt

[Serge]

I guess if you took the time but from what I hear md5 is not ment to be de-crypted that is why we are compairing the two I guess. Correct me if I'm wrong.

[filburt1]

It's not encrypted or decrypted. Hashing is a one-way algorithm. The only way to effectively "unhash" something is via a brute force attack.

[Xenon]

Dean: as filburt stated, md5 is a hash-algorithm, (speak several different strings will produce the same hash)
so it's mathmatically impossible to decrypt it.
BUT: it is possible to find a way to find matching passwords if you know the hash, but it's a very hard way, just a little faster than bruteforce maybe