Why passwords are stored in a database with MD5 values

1, why is the MD5 value of the password stored in the database, not the plaintext?

The first thing we confirm is thatMD5 must be safer than clear (certainly not the safest).

If the database is stored in clear text, if the database is hacked, then the plaintext password is compromised so that ordinary users can easily log in.

However, if the MD5 value is stored, even if the leak, the ordinary user can not log on . Because the text is required to enter plaintext when logging on the page.

Of course, the programmer can directly invoke the login interface, pass the password MD5 value can also log in.

Another point: The plaintext contains more information (relative to its MD5 value), such as the clear text may be the bank password, or contains the date of birth, etc., these are sensitive information.

after using MD5, the sensitive information is erased . That is, the amount of information is reduced.

If you use clear text storage, the network transmits the password plaintext when you log in.

2. Problems encountered

If the database stores the password MD5 value, then the password strength is not easy to calculate .

Because the password strength is calculated based on the password plaintext, not the MD5 value of the password, but the MD5 value of the password is stored in the database.

The password strength cannot be calculated according to the MD5 value because the MD5 value is not reversible, that is, the plaintext cannot be obtained according to the MD5 value.

So at this point the password strength should be in the front check

Principles :

(1) In the network transmission, cannot transmit the password plaintext;

(2) password plaintext cannot be landed , that is, password plaintext can not be stored anywhere, including database, browser cookie

(3) Even if the database is hacked, the hacker will not be able to calculate the plaintext

Reference: http://hw1287789687.iteye.com/blog/2248374

http://hw1287789687.iteye.com/blog/2248365

This article is from the "Whuang" blog, make sure to keep this source http://huangkunlun520.blog.51cto.com/2562772/1702436

Why passwords are stored in a database with MD5 values