Same number of characters in password after md5

Question

I’m doing a process of opening a modal and registering a user. User password is modified to md5();

After this the password is with 32 caracteres.

When user will load user data to make an update.

If the password was:

123456
****** <- 6 caracteres

Show in input:

*************************** <- 32 caracteres

Would there be some way to know how much they were before doing the md5(), or perhaps a better approach.

It would be impractical to store the amount of characters in db to accomplish this.

Answer 1

There is no way to know the number of characters of a md5 hash, precisely because it is one-way, and that is its purpose.

One way to know how much was before would be to save that amount in a database field, which is complements impracticable in the question of safety.

Take the example of some bank sites, you type your password in the input that only goes up to 5 characters and does not display anything else you type after the 5th digit, even if it is just asterisks, or the Linux example, which simply does not show your password while you are typing.

You could do as previously suggested, put a fixed amount in your input and when the user clicks, reset the field, would be the most practical and also the most used solution.

Also try to change your encryption method to use a salt+password, and then generate a hash using SHA512, it is more indicated than just using md5 and run the risk of your password being found in a rainbow table.

And never use user name as salt.

Answer 2

Unable to return to md5. Not in a fast and practical way.

I don’t know why you want to display this way, but on my user screens I don’t show the password field. Just a "Change password" link that opens a modal.

Answer 3

It’s not possible in a practical way. And, if it’s possible for you, it’s possible for external attackers. If you saw someone doing it, that person is not taking security seriously.

By the way, DON’T USE MD5! MD5 is demonstrably flawed for security purpose. Prefer SHA256, as even SHA1 is already being abandoned for security reasons.

Answer 4

Would have some way of knowing how many characters were before doing md5() ?

Not securely! No matter what encryption you use md5, sha1 or sha256 bringing the hash to the client would not be a good way to solve the problem.

There is a better approach ?

The Comment of @Sanção behind 2 approaches:

1 - Leave fields empty.

If the user type something you will understand by the amount of characters in the field that is to do an update.

2 - Set a fixed number of characters.

Case the user of a phocus in the characters delete them and let him type in the new password.

Edit

You can give a placeholder in the input, it is similar to our login screen http://answall.com:

<label>Digite sua Senha:</label>
<br>
<input type="password" placeholder="******* Nova senha" size="25">
<br>
<input type="password" placeholder="******* Confirmar senha" size="25">

Answer 5

First, by answering the question. Yes, it is possible, if the input value is equal to the existing value in the database before it is encrypted.

Encrypting the input value and compared to the existing value, you get the same return.

function senha($arg){
    $md5 = md5($arg, true);
    return substr($md5, 0, 22);
}

print senha('1234');
print "<br/>";
print senha('1234');

$senha_armazenada = senha('1234');
if($senha_armazenada === senha('1234')){
    print "senha confere";        
} else {
    print "senha nao confere";        
}

However cryptographic functions such as md5, sha1 and hereafter, are considered unfit for such tasks as "easy" to break. Although they seem indestructible, nowadays there is immense processing power and immense techniques to get the true value of this hash.

To create a hash safe, currently there are 2 important factors to take into account:

• The cost (time the computer will take to generate this hash).
• salt (a unique increment, which makes hash unique for each case).

The PHP >= 5.5.0 possesses native functions to create, check safe hashes without much effort. For older versions PHP < 5.5.0, there are ways to get the same result, also explained here.

Instead of using md5, you can use the native functions of PHP >= 5.5.0 to create something more secure.

<?php

header("Contet-Type: text/html; charset=utf-8;");

$usuarios = array(
    0 => array(
        'id'=>1,
        'nome'=>'Edilson',
        'hash'=>'$2y$10$i260FJQg7VgsNjXl6s9Mje9aqXUGbfa9L/c8bA2NOUHyDVoyJoyQu'
        ),
    1 => array(
        'id'=>1,
        'nome'=>'Samuel',
        'hash'=>'$2y$10$r1wD4rLLgB1jm6ExF.Em5eyKXdK4Wn8f6z.G9fsxmc3xXay4.pI/O'
        )    
    );


function logar($usuario, $senha){
    global $usuarios;
    foreach($usuarios as $key=>$set){
        if(in_array($usuario, $set)){
            if(password_verify($senha, $set['hash'])){
                return true;
            }
        }
    }
    return false;
}

function cadastrar($usuario, $senha){
    global $usuarios;
    if(!empty($usuario) && !empty($senha)){
        $hash = password_hash($senha, PASSWORD_BCRYPT);
        $id = mt_rand(3,50);
        if(array_push($usuarios, array('id'=>$id, 'nome'=>$usuario, 'hash'=>$hash))){
            return true;
        }
    }
    return false;
}

//var_dump(cadastrar('Edilson','password')); # (true/cadastrado)
var_dump(logar('Edilson', 'password')); # (true/logado)
var_dump(logar('Samuel', '1234')); # (true/logado)print_r($usuarios);

?>

Here for example, the variable $usuarios functions as a table in the database, and when the function logado is called, it looks in this array, the corresponding hash, and compares, through the function password_verify, which returns true if both are equal, or false if the comparison fails.

Recommended:

• Secure password hash

Answer 6

The md5() is irreversible, the encrypted password is not accessible, the amount of characters will always be 32, the rash of the md5 can be repeated even if they have passwords of different characters. One of the safe ways to create passwords is through the password_hash php.net.

<?php
require 'password.php';

$passwordHash = password_hash('secret-password', PASSWORD_DEFAULT);

if (password_verify('bad-password', $passwordHash)) {
    //Senha correta
} else {
    //Senha errada
}

The query for an MD5 will always be through a valid password of type:

'SELECT * FROM TABELA where senha=MD5(:senha)'