0

The website that I'm working on hashes login passwords with MD5.

A user's just forgotten his password so I'm on the database and I set the password to one of mine...

update users set pass = md5('thiS1smyp4s5w@rd')
where userid = 974

While the application uses MD5 hashing and I've set the password with Md5 hashing, I still can't log in with this user's details and I was wondering...

Are hashing algorithms the same across platforms or is there some difference between the way it's done in .NET as opposed to how it works in MySQL that would cause the hash values to differ?

2

1 Answer 1

0
  1. PLEASE don't use MD5 to hash passwords, it's not secure; use BCrypt or PBKDF2.
  2. The MD5 specification should be consistent regardless of platform, that said one thing that can cause issues is the fact that the letters in the hexits which are output maybe a different case (e.g. upper case instead of lower case), this only matters in case sensitive database queries.
  3. That said passwords can be salted in order to prevent Dictionary Attacks, a salted hash is completely different to one which isn't salted thanks to the Avalanche Effect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.