Originally Posted by TSM (Post 2053691)

the normal way is to hash the username & password together, well thats nix way from what i remember

Originally Posted by TSM (Post 2053691)

i somtimes hash it with the IP address & session_id if i want a temporary password, many diffrent ways
passwords in DB are usualy not done with a master seed though, if you loose that then you are stuffed

Originally Posted by Kinvig (Post 2054585)

[tech derail]




Yup, I hash using either username or email address. It's the one time on a website that I'll use javascript for "core" functionality as I don't want an unhashed pwd gonig back & forth between server & client.



You can't always rely on a client's browser maintaining 1 ip address for its session. Apps such as AOL seem to let the AOL browser use a roaming/floating ip address range - hence all the issues that you get with AOL users.

[/tech derail]

Originally Posted by -KINGVIG-TSM (Post 2054590)

Bla bla bla tech'y bolarx bla bla bla mind melted, now cream pie'd

Originally Posted by TSM (Post 2054028)

naa, ive confirmed its you, sure you remember who you are :p