*urgent* anyone else heard about the password leak?

[Kinvig]

[tech derail]

Originally Posted by TSM

the normal way is to hash the username & password together, well thats nix way from what i remember

Yup, I hash using either username or email address. It's the one time on a website that I'll use javascript for "core" functionality as I don't want an unhashed pwd gonig back & forth between server & client.

Originally Posted by TSM

i somtimes hash it with the IP address & session_id if i want a temporary password, many diffrent ways
passwords in DB are usualy not done with a master seed though, if you loose that then you are stuffed

You can't always rely on a client's browser maintaining 1 ip address for its session. Apps such as AOL seem to let the AOL browser use a roaming/floating ip address range - hence all the issues that you get with AOL users.

[/tech derail]

[TSM]

Originally Posted by Kinvig

[tech derail]




Yup, I hash using either username or email address. It's the one time on a website that I'll use javascript for "core" functionality as I don't want an unhashed pwd gonig back & forth between server & client.



You can't always rely on a client's browser maintaining 1 ip address for its session. Apps such as AOL seem to let the AOL browser use a roaming/floating ip address range - hence all the issues that you get with AOL users.

[/tech derail]

This is true, but if you check for the proxy header, you should be able then able to change the hasing method. If all else fails, i usualy make it possable disable bind to ip.

[Owenski]

Originally Posted by -KINGVIG-TSM

Bla bla bla tech'y bolarx bla bla bla mind melted, now cream pie'd

lol, Im sure it made perfect sense to you guys but that totally went over my head rofl.

[Warthog]

Originally Posted by TSM

naa, ive confirmed its you, sure you remember who you are

I'm Spiderman aren't I?