Post
Topic
Board Project Development
Re: [Pre Announcement] PHPCoin
by
BCwinning
on 12/08/2011, 19:53:55 UTC
As password security is the subject of the moment, due that MtGox thing, here's my system's function for it:

Code:
       $salt md5(rand().$name.microtime());
       
$passh hash("ripemd160",$pass.$salt);
       
mysql_query("INSERT INTO users(user,pass,name,email) VALUES('$user','$passh','$name','$email')");
       
$myuid mysql_insert_id();
       
mysql_query("INSERT INTO salt(uid,salt) VALUES($myuid,'$salt')");
       
$success "You're now registered to this system";
?>


Your method is not good enough (not mentioning it seems you are not escaping properly variables when passing them to mysql).

I could do 50000 iterations of ripemd160 in 94.16ms without any optimization. I'd suggest you at least add some iterations to make bruteforcing harder.
hilarious mtgox is now an expert on security. oh the irony
I'm confused??