Redundant md5 of an md5 of an md5

[OzRoy]

Hi guys.

We just recently upgraded our forums to VB3. It's only after doing this we realised that VB3 stores the password in the DB as an md5 of an md5 + random string. Not only that but the cookie that is sent to the user is another md5 of the DB's md5 + random string. So the final user cookie is an md5 of an md5 of an md5!

Can this please be changed. I do not believe this to be any more secure than other solutions and all it has achieved is major headaches.

We use our forums as the central part of our network. Included in this is FTP to certain client websites. To do that we use pure-ftpd. Pure has the ability to read usernames and passwords from a DB, and it quite happily works with plain md5 hashes, but obviously will not work with the VB3 system. It has irreversibly broken our system. Our only option now is to hack the VB code, and restore our user table from a DB backup meaning we lose new registrations from the last week.

I can't think of any reason for this massive overkill. An md5 is irreversible. So it should be virtually impossible to determine the users password from just a single md5 hashed password stored in the database. Granted a hacker could do a brute force attack on that value, but the only people who should have access to that are the site admins, AND even in it's current state, being a site admin, I know all the random string values and can STILL do a brute force attack on the value to get the original password.

So that leaves the user cookie. All that needs to be done is to create an md5 of the md5+random string. This at least makes it slightly more secure. But any hacker who is able to sniff the cookie value already has everything that they need. They no longer need to know what the real password is. The cookie value will give them access. If you really want to make this harder and a bit more secure then the cookie value should be an md5 of the md5 + random string + IP Address. Then the hacker will have to spoof their own ip address as well. And honestly who could be bothered doing that just to get access to a forum?

Maybe I'm missing something here, and if so please inform me. If not however, then please fix this, or at least make it an option! I do not want to have to have to fix this every time I upgrade the forum.

[OzRoy]

Ignore this. I posted this on the official vb forum