Encoding Password

[Jemts]

I was thinking of ways to take a password and when you save it encode it. Are there any widley use advance way to do this safely?

Jemts

"If you're traveling in a time machine, and you're eating corn on the cob, I don't think it's going to affect things one way or the other. But here's the point I'm trying to make: Corn on the cob is good, isn't it."

[knobunc]

It depends what you want to do.

Do you want to:

1. Be able to get the exact text back later? e.g. to pass to a different program to authenticate the user.
2. Be able to simply check that the password given matches the one previously given

The two cases are different since in the first you have to have a reversible way of getting it out which is pretty much going to be unsafe no matter what. If you can do the second case you can use the crypt function to munge the password, store the munged version and then later munge the new password given and compare the two munged versions. That way you never need to store the cleartext version.

If that doesn't help, tell us what you are really trying to do and we will help.

-ben

[Sherlock]

You can probably turn up a lot of information on this topic if you use Super Search. You can take a look here to get a nice tutorial of how to use encryption. That link came from this node and there are lots of others around here such as How do I decode encrypted password files? and A very simple userid/password check. Hopefully, some of these will have what you're looking for.

If you still can't find what you're looking for or are having trouble with a specific portion of the encryption, post what you're having trouble with and maybe I can be of more help. Hopefully, this will at least get you started.

Good luck,
- Sherlock

Skepticism is the source of knowledge as much as knowledge is the source of skepticism.

[thpfft]

You might want to try Apache::Htpasswd. It gives more or less transparent access to apache authentication. Two possible drawbacks, though: it's very hard to force a logout without ending the browser session if you log in via apache, and this falls into knobunc's second category, ie you can still check against the encrypted version but never get the plaintext version of the password back again.

[ZZamboni]

See also this thread, which generated some useful discussion and information.

--ZZamboni