How vanilla encodes passwords?

luisgzafra · May 2012

I saw it was in md5, but not sure, can you clarify me?

luisgzafra · May 2012

I have to use it in another script that is not vanilla, so it was like this:

$Vanilla_PasswordHash = new PasswordHash();

$a =  $Vanilla_PasswordHash->HashPassword('123456');
echo $Vanilla_PasswordHash->CheckPassword('123456', $a, 'Vanilla');
echo $a;

Now all I have to change the subdomain HashMethod vanilla to the site, a random string or something.

Although return different strings, it works.

Solved, Thanks! ;)

*How do i thank on this board? ¿Karma or something?

aery · May 2012

passeords are in md5 hash

x00 · May 2012

sort of.

you can use different ways. the default is phppass

which is simular to md5 and uses it in it algorithm

http://www.openwall.com/phpass/

x00 · May 2012

aery said: passeords are in md5 hash

actually not quite

luisgzafra · May 2012

For example, for 123456 it save in User (table), Password = $P$BrCcPc.mOwmL.7dO6EExggauzt0YqG/

For 111111 I need get the hash.

I only need encode.

I'm seeing PasswordHash class, I'll look phpass

x00 · May 2012

 $PasswordHash = new Gdn_PasswordHash();
 $PasswordHashed = $PasswordHash->HashPassword($Password);

luisgzafra · May 2012

I saw that, but generates a random string is not always the same pass.

I need it when creating a new site, insert the password of the administrator.

I think the HashMethod row has something to do.

luisgzafra · May 2012

$PasswordHash->CheckPassword('123456', '$P$BrCcPc.mOwmL.7dO6EExggauzt0YqG/', 'Vanilla');

returns true.

I'm still seeing this class.

x00 · May 2012

Yes you need both the stored hash and the suposed password to check. This is an extra layer of security.

They are not directly compared, in effect phppass uses crypt_private to retrieve the actual hash that can be compared to the storedhash

Have a look at CheckPassword

x00 · May 2012

HashMethod row determines whether you are goign to use phppass in the first place.

x00 · May 2012

so the method is if there is already a record you need both the stored has hash the password to create a hash to compare to the stored hash. Make sense?

x00 · May 2012

so the user either exist, or you create them.

luisgzafra · May 2012

You must also add $portable_hashes = 'vanilla'.

luisgzafra · May 2012

I leave it written for anyone else who needed it in the future ...

peregrine · May 2012

luisgzafra said:

*How do i thank on this board? ¿Karma or something?>

You click like on x00's comments.

luisgzafra · May 2012

Thanks @peregrine!

Howdy, Stranger!

Categories

In this Discussion

How vanilla encodes passwords?

Best Answer

Answers