[Phreak]

I've seen a few tutorials making use of random salts to hash the passwords, but I assume there's no reason to do so if I'm gonna save them next to the passwords anyway.

I'm using mysql, so where should I save the salts?
Is it possible (and viable) to work with two databases at the same time? Should I save them instead in a separate ini file? Give me some suggestions.

[DeepCode]

Quote:

Originally Posted by Phreak but I assume there's no reason to do so if I'm gonna save them next to the passwords anyway.

Not quite. If you're using password + salt then that will be kinda hard to decrypt passwords even if they stored in the same db. But if you're still scared about how safe it is then you could use 2 (or more) different connections and store salt and passwords in different databases.

[Sithis]

The only reason you would use a salt is to slow down an attacker. If they have access to your database it's a lost cause anyway.

It is perfectly fine to store the unique salt alongside the hash in the same table. Assuming you use a strong cipher algorithm, a UNIQUE PER-PLAYER salt and enough iterations, you have a better security than 80% of the web services in the world.

[Phreak]

Ok but let's say someone used an easy password like "123456" which will probably be in every dictionary ever.
Couldn't the attacker just add the salt to the password and hash it then compare the hashes?
In this case a salted hash wouldn't be much more effective than one that is not salted.

[SkmDanny]

Quote:

Originally Posted by Phreak Ok but let's say someone used an easy password like "123456" which will probably be in every dictionary ever. Couldn't the attacker just add the salt to the password and hash it then compare the hashes? In this case a salted hash wouldn't be much more effective than one that is not salted.

You can use the standard salt for passwords:

PHP код:

new MyHash[65];
SHA256_PassHash("test", "78sdjs86d2h", MyHash, sizeof MyHash); 


And you can create a variable what is asking a player, when he is wanting to register, to be needed add a uppercase letter, a number or a character ("@#$%&").
You just need to use your imagination.

Example: #LoveMyPass1337