LoginLogin

How are passwords stored?

Root / Site Discussion / [.]

NeatNitCreated:
NeatNit#1
It's pretty important to store passwords correctly. In fact, the best pactice is not to store passwords at all and instead, use a "log in with Google"/Facebook/whatever button, essentially removing all password theft security risks and relying on the other service's security - which is probably great because they're huge companies. But clearly, SmileBASIC Source uses its own user accounts and its own passwords, so you have to store them somewhere! Now, as far as I know, the current best practice is to take the password, add some salt (basically a long string that is specific to each user), and use a hashing algorithm on that - then store that. Is this what you're doing? (if not, better do it ASAP)
haloopdy#2
Yes, they're hashed and salted with modern cryptography. No, we're not requiring ANOTHER account just to log into this account. The database has no external access either; someone would need root access to our server to even get the hashes.
NeatNit#3
Awesome, never expected any less just wanted to make sure :) Thanks! BTW, I saw in the About page that your email is randomouscrap98. Were you born in 1998? That would make you 4 years younger than me and way smarter than I was at your age (and honestly, probably smarter than I am now)
haloopdy#4
Oh no, that was the first time I made an email account. I just kept the number because... IDK. I was born in 91, so I'm not actually smart >.<
NeatNit#5
I was born in 91, so I'm not actually smart >.<
That's not how smartiness works!
12Me21#6
There are ways to tell if someone knows their password without transmitting it, or an encrypted version. https://en.wikipedia.org/wiki/Zero-knowledge_proof
MasterR3C0RD#7
Okay, people, Random has explained this stuff before to me in chat, so might as well tell. When you log in, the webpage sends the username and a MD5 hash of your password. The account name is first checked on the MySQL server (which is not port forwarded, so no one can hack it). If it doesn't exist, the server says that the username or password. If it does, then the server hashes the MD5 hash with Bcrypt, and compares that hash with the one stored on the database. If the hashes match, a session key is sent (as a cookie) to you, and you're now logged in until you close your web browser tab (unless you click Remember me). Else, you're sent a message that the username or password is incorrect. Now, Bcrypt is one of the best hashing functions, and the MySQL server isn't outside the firewall, so you're not gonna get hacked. So don't worry about security (especially since CloudFlare automatically sets up SSL).