Why passwords are stored in a database with MD5 values

Source: Internet
Author: User

1, why is the MD5 value of the password stored in the database, not the plaintext?

The first thing we confirm is thatMD5 must be safer than clear (certainly not the safest).

If the database is stored in clear text, if the database is hacked, then the plaintext password is compromised so that ordinary users can easily log in.

However, if the MD5 value is stored, even if the leak, the ordinary user can not log on . Because the text is required to enter plaintext when logging on the page.

Of course, the programmer can directly invoke the login interface, pass the password MD5 value can also log in.

Another point: The plaintext contains more information (relative to its MD5 value), such as the clear text may be the bank password, or contains the date of birth, etc., these are sensitive information.

after using MD5, the sensitive information is erased . That is, the amount of information is reduced.

If you use clear text storage, the network transmits the password plaintext when you log in.

2. Problems encountered

If the database stores the password MD5 value, then the password strength is not easy to calculate .

Because the password strength is calculated based on the password plaintext, not the MD5 value of the password, but the MD5 value of the password is stored in the database.

The password strength cannot be calculated according to the MD5 value because the MD5 value is not reversible, that is, the plaintext cannot be obtained according to the MD5 value.

So at this point the password strength should be in the front check

Principles :

(1) In the network transmission, cannot transmit the password plaintext;

(2) password plaintext cannot be landed , that is, password plaintext can not be stored anywhere, including database, browser cookie

(3) Even if the database is hacked, the hacker will not be able to calculate the plaintext

Reference: http://hw1287789687.iteye.com/blog/2248374

http://hw1287789687.iteye.com/blog/2248365


This article is from the "Whuang" blog, make sure to keep this source http://huangkunlun520.blog.51cto.com/2562772/1702436

Why passwords are stored in a database with MD5 values

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.