3

When I reset my password with the same password I used before. I checked the MySQL database the old encrypted password is different from new encrypted password.

Do you guys know why?

7

That's because Craft follows the standard procedure of hashing passwords with what's called a "salt" as a security measure.

Think about it this way - if a password were hashed without a salt, every instance of the same password would result in the same hashed value.

Example:

Suppose there are two users, Foo and Bar. They both choose password123 as their password. When hashed without a salt, their passwords would look the same after hashing, which is a security flaw.

We can see this by testing it with any hash algorithm:

(I'm using md5 here for readability because it gives a shorter result - do not actually use md5 for anything secure)

password123 becomes 482c811da5d5b4bc6d497ffa98491e38, and - without using a salt - would be stored that way for every user with the password password123.

The implication here is that the system is now vulnerable to a variety of attacks, like Lookup Tables and Rainbow Tables, which depend upon every instance of a password yielding the same hash.

Enter Salts. Salts are psuedo-random strings attached to the user's password prior to being hashed and stored.

In our Foo and Bar example, that would look something like this:

Foo chooses password123. The system generates a psuedo-random "salt" of pg7n6yVBzWJbaxfF, combines them into pg7n6yVBzWJbaxfFpassword123, and then hashes that result to get d026a6847c743e23195cf37db2a66ae9. In addition, Foo's generated salt is stored in the table, so that it can be used to test login attempts.

Bar does the same, but the system generates Am6g4n0JEFdE1poH as his salt. When combined with password123 and hashed, it then yields a different result: 5e7b0bb4842ee8315105a62922c32894.

Both users have the same password, but the final hashed result now has no traceable relationship to the original password in either case. If a malicious party were to try and search for password123 by scanning the database for its hashed equivalent (in our example 482c811da5d5b4bc6d497ffa98491e3), it wouldn't find anything.

The same principle applies to resetting your password - even if you choose the same password, that new instance of the password is re-salted, re-hashed, and stored as something distinct.

  • Sam, do you know if Craft passwords also have an application-wide "pepper" added? This would be an added layer of security for when the MySQL data was breached (such as via SQL injection) but without access to the PHP code. – Simon East Feb 19 '18 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.