I'm working with a legacy codebase here that currently uses OLD_PASSWORD()
as a simple hashing function. This codebase now needs to connect to a database running the newest revision of MySQL 5.7.
The equivalent of PASSWORD()
seems to be: UPPER(SHA1(UNHEX(SHA1(password))))
.
Is there a similar equivalent to OLD_PASSWORD()
?
OLD_PASSWORD()
for user authentication is a terrible idea, so if you can replace this with something actually secure you'd be in much better shape. IsOLD_PASSWORD()
just unsalted MD5? You could do tests to find out. If it is, it's utterly useless in terms of protection. – tadman Jun 2 '16 at 15:46OLD_PASSWORD()
appears to return a halved MD5 string (16 chars), but isn't actually. – Chris Bornhoft Jun 2 '16 at 15:52