Do you have security issues on your web application regarding user profiles stored in a database with plain text passwords? A recent article by James McGlinn over at PHP Security Consortium offers a solution to this problem with password hashing. James explains what a hash is, why you would want to use it instead of storing real passwords in your applications, and provides some examples of how to implement password hashing in PHP and MySQL. “Password hashing is a way of encrypting a password before it's stored so that if your database gets into the wrong hands, the damage is limited”, writes James.

James explains lucidly about hashes and their necessity. A hash (also called a hash code, digest, or message digest) can be thought of as the digital fingerprint of a piece of data. You can easily generate a fixed length hash for any text string using a one-way mathematical process. It is next to impossible to recover the original text from a hash alone. It is also vastly unlikely that any different text string will give you an identical hash, also called a 'hash collision'. James questions as to why these properties make hashes ideally suited for storing your application's passwords. He is quick to answer, “Because although an attacker may compromise a part of your system and reveal your list of password hashes, they can't determine from the hashes alone what the real passwords are.”

So the question is, ‘How do you authenticate users?’ James has that figured out, as he has established that it's incredibly difficult to recover the original password from a hash, so you will know if a user has entered the correct password by generating a hash of the user-supplied password and comparing this 'fingerprint' with the hash stored in your user profileto see whether or not the passwords match.

James points some weaknesses too. “The attacker can generate hashes for numerous potential passwords. The hashes generated are compared with those in your user database and any matches will reveal the password for the user in question.” Creating a random string of characters of a predetermined length, and adding this string to your plain text password can overcome these weaknesses, reassures James.