I've seen this information in other articles but most were salting with a known value (like a username). Is salting a password with the joined
datetime (or an MD5 of the joined
datetime) a secure way of further securing credentials if the joined
data is not exposed anywhere 开发者_开发百科in the site?
Thanks in advance!
Salt with a truly random salt instead. Guessing a date based salt seems a little too easy, especially if someone is aware how long the person has been a member of the site.
You could do something like:
$salt = substr(sha1(uniqid(mt_rand(), true)), 0, 16);
I actually did something like this:
$password = mysqli_real_escape_string($connect, $_POST['password']);
$salt_shaker = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
$salted = $password.$salt_shaker;
精彩评论