开发者

Salting a password with a "joined" datetime

I've seen this information in other articles but most were salting with a known value (like a username). Is salting a password with the joined datetime (or an MD5 of the joined datetime) a secure way of further securing credentials if the joined data is not exposed anywhere 开发者_开发百科in the site?

Thanks in advance!


Salt with a truly random salt instead. Guessing a date based salt seems a little too easy, especially if someone is aware how long the person has been a member of the site.

You could do something like:

$salt = substr(sha1(uniqid(mt_rand(), true)), 0, 16);


I actually did something like this:

$password = mysqli_real_escape_string($connect, $_POST['password']);
$salt_shaker = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
$salted = $password.$salt_shaker;
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜