Quote from: MagicalTux on July 15, 2011, 12:01:40 AM

Quote from: BCEmporium on July 14, 2011, 12:26:06 PM

As password security is the subject of the moment, due that MtGox thing, here's my system's function for it:

Code:

       $salt = md5(rand().$name.microtime());
       $passh = hash("ripemd160",$pass.$salt);
       mysql_query("INSERT INTO users(user,pass,name,email) VALUES('$user','$passh','$name','$email')");
       $myuid = mysql_insert_id();
       mysql_query("INSERT INTO salt(uid,salt) VALUES($myuid,'$salt')");
       $success = "You're now registered to this system";
?>

Your method is not good enough (not mentioning it seems you are not escaping properly variables when passing them to mysql).

I could do 50000 iterations of ripemd160 in 94.16ms without any optimization. I'd suggest you at least add some iterations to make bruteforcing harder.

Quote from: NothinG on August 12, 2011, 07:52:11 PM

Quote from: BCwinning on August 12, 2011, 07:46:28 PM

hilarious mtgox is now an expert on security. oh the irony

I'm confused??