How vanilla encodes passwords?

luisgzafra

How vanilla encodes passwords?

I saw it was in md5, but not sure, can you clarify me?

luisgzafra

I have to use it in another script that is not vanilla, so it was like this:

$Vanilla_PasswordHash = new PasswordHash();

$a =  $Vanilla_PasswordHash->HashPassword('123456');
echo $Vanilla_PasswordHash->CheckPassword('123456', $a, 'Vanilla');
echo $a;

Now all I have to change the subdomain HashMethod vanilla to the site, a random string or something.

Although return different strings, it works.

Solved, Thanks!

*How do i thank on this board? ¿Karma or something?

aery

passeords are in md5 hash

x00

sort of.

you can use different ways. the default is phppass

which is simular to md5 and uses it in it algorithm

http://www.openwall.com/phpass/

x00

aery said:
passeords are in md5 hash

actually not quite

luisgzafra

For example, for 123456 it save in User (table), Password = $P$BrCcPc.mOwmL.7dO6EExggauzt0YqG/

For 111111 I need get the hash.

I only need encode.

I'm seeing PasswordHash class, I'll look phpass

x00

 $PasswordHash = new Gdn_PasswordHash();
 $PasswordHashed = $PasswordHash->HashPassword($Password);

luisgzafra

I saw that, but generates a random string is not always the same pass.

I need it when creating a new site, insert the password of the administrator.

I think the HashMethod row has something to do.

luisgzafra

$PasswordHash->CheckPassword('123456', '$P$BrCcPc.mOwmL.7dO6EExggauzt0YqG/', 'Vanilla');

returns true.

I'm still seeing this class.

x00

Yes you need both the stored hash and the suposed password to check. This is an extra layer of security.

They are not directly compared, in effect phppass uses crypt_private to retrieve the actual hash that can be compared to the storedhash

Have a look at CheckPassword

x00

HashMethod row determines whether you are goign to use phppass in the first place.

x00

so the method is if there is already a record you need both the stored has hash the password to create a hash to compare to the stored hash. Make sense?

x00

so the user either exist, or you create them.

luisgzafra

I have to use it in another script that is not vanilla, so it was like this:

$Vanilla_PasswordHash = new PasswordHash();

$a =  $Vanilla_PasswordHash->HashPassword('123456');
echo $Vanilla_PasswordHash->CheckPassword('123456', $a, 'Vanilla');
echo $a;

Now all I have to change the subdomain HashMethod vanilla to the site, a random string or something.

Although return different strings, it works.

Solved, Thanks!

*How do i thank on this board? ¿Karma or something?

luisgzafra

You must also add $portable_hashes = 'vanilla'.

luisgzafra

I leave it written for anyone else who needed it in the future ...

peregrine

luisgzafra said:

*How do i thank on this board? ¿Karma or something?>

You click like on x00's comments.

luisgzafra

Thanks @peregrine!