Re: Source of bad password hashing practices? MySQL manual...

[Raphael Geissert <geissert () debian org>]

On 9 October 2013 01:57, Rich Felker <dalias () aerifal cx> wrote:
>   "Do not store cleartext passwords in your database. If your computer
>   becomes compromised, the intruder can take the full list of
>   passwords and use them. Instead, use SHA2(), SHA1(), MD5(), or some
>   other one-way hashing function and store the hash value."
>
>   (http://dev.mysql.com/doc/refman/5.7/en/security-guidelines.html)

They probably don't mention the use of ENCRYPT (think of it as an
alias to crypt(3)) because it is not portable to Windows-based
systems, but I find the following bit quite amusing:

http://sources.debian.net/src/mysql-5.5/5.5.33+dfsg-1/sql/item_strfunc.cc?hl=1877#L1889

(yeah, that's in their implementation of ENCRYPT())

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net