Welcome to the Second Life Forums Archive

These forums are CLOSED. Please visit the new forums HERE

md5 encryption..strange behavior

Nichiren Dinzeo
Registered User
Join date: 14 Feb 2007
Posts: 203
02-22-2007 09:16
simple table with username and password using md5 encryption.
user POPSHUVITS with pword SALERO added to the table. A browse of the table shows pword as 015ed62fe

//Now, in a login script if the user signs in I get the following :

015ed62fe031ad4895b025c92a5a83aa Incorrect password, please try again.

//I am echoing the pword the user puts into the login.php and as you can see it does return the password encrypted correctly 015ed62fe..but it has a bunch of other junk in it
031ad4895b025c92a5a83aa

any clue as to why?

here is the code snippet I am using in the login.php

while($info = mysql_fetch_array( $check ))
{

$_POST['pass'] = stripslashes($_POST['pass']);



$info['mem_pword'] = stripslashes($info['mem_pword']);

$_POST['pass'] = md5($_POST['pass']);

echo $_POST['pass']; //this has the correct pword but other junk..see above
//echo $info['mem_pword']; //echoing the pword from the db shows the md5pword in the db correctly.

//gives error if the password is wrong

if ($_POST['pass'] != $info['mem_pword']) {
die('Incorrect password, please try again.');
}

else
{
bucky Barkley
Registered User
Join date: 15 May 2006
Posts: 200
02-22-2007 10:19
" A browse of the table shows pword as 015ed62fe"

md5 returns 32 characters...

And if you are merely doing md5 on the password alone, with no
salt, the result is very weak ... go check:

http://md5.rednoize.com/
http://en.wikipedia.org/wiki/MD5

The other thing that occurs to me is:

* how are you storing the password? (all 32 chars?)
* when the user inputs a password, are you doing an md5 on that,
and dropping the last 24 characters before comparing?

I would likely concatenate the agent id to the cleartext password, along with
perhaps sim coordinates. When the user goes to authenticate, they type in
their password, and the object provides the other two pieces (one of which is
unique to the user).
Nichiren Dinzeo
Registered User
Join date: 14 Feb 2007
Posts: 203
02-22-2007 10:31
thanks...I figured out my problem....by table entry for password was set to a length of 10...I changed to 40 and now it works....ugh...