3 ms·
* MD5 of the bcrypted pass+username * How do you verify that? Since bcrypt generates a random salt when you hash a value, if you MD5 the resulting hash, you lo
by Osiris 11y ago
* MD5 of the bcrypted pass+username *
How do you verify that? Since bcrypt generates a random salt when you hash a value, if you MD5 the resulting hash, you lose the salt. So, are they storing the bcrypt work factor and salt but doing an MD5 only on the hash portion? Seems like a needless extra step. Storing the bcrypt work factor, salt, and hash should be sufficiently secure.
Unless you meant bcrypt(md5(pass+username)).
- ecnahc515 11y agoPretty sure they mean bcrypt(md5(pass+username)) since changing hashing algorithms is generally an additive change.
- itslennysfault 11y agoThere is no need to "verify" it was just a $loginkey used for automatic login. It's just a hash of: md5(lc($usename).”::”.lc($bcrypt-string)) They generate one and store it in the database and just do a basic string compare against the one used to auto-login.