Post
Topic
Board Project Development
Re: [Pre Announcement] PHPCoin
by
MagicalTux
on 15/07/2011, 00:01:40 UTC
As password security is the subject of the moment, due that MtGox thing, here's my system's function for it:

Code:
       $salt md5(rand().$name.microtime());
       
$passh hash("ripemd160",$pass.$salt);
       
mysql_query("INSERT INTO users(user,pass,name,email) VALUES('$user','$passh','$name','$email')");
       
$myuid mysql_insert_id();
       
mysql_query("INSERT INTO salt(uid,salt) VALUES($myuid,'$salt')");
       
$success "You're now registered to this system";
?>


Your method is not good enough (not mentioning it seems you are not escaping properly variables when passing them to mysql).

I could do 50000 iterations of ripemd160 in 94.16ms without any optimization. I'd suggest you at least add some iterations to make bruteforcing harder.