Re: [PHP-DB] md5 question!
On Tuesday 24 June 2003 22:36, Peter Beckman wrote: > Most sites save/allow an 8 character password. Allowing alphanumerics and > underscore, period and pound (_, ., #), that is 39^8, or 5,352,009,260,481 > or about 5 trillion possible passwords. If you allow more than 8 > characters, that number increases. If you're using md5 then there is no inherent restriction on what characters and number of characters that can be used in the password. The limitations are in the user, they'll probably use their phone number, DOB, dog's name -- anything that's easy to remember ;-) -- Jason Wong -> Gremlins Associates -> www.gremlins.biz Open Source Software Systems Integrators * Web Design & Hosting * Internet & Intranet Applications Development * -- Search the list archives before you post http://marc.theaimsgroup.com/?l=php-db -- -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
On Tuesday 24 June 2003 21:08, JeRRy wrote: > I guess technically there MUST be a way to break the > barrier where you can reverse it. If there is a way > to make it there is always a way to break it, somehow. > Consider that whatever sized input you give it, after it's been md5'ed, you'll get a 32 char hex string. Now how can a 32 byte string be converted back into a multi-gigabyte file (or whatever)? It is technically possible to create two different inputs which results in the same hash but the chances of that is very remote and hence why md5 is pretty secure. -- Jason Wong -> Gremlins Associates -> www.gremlins.biz Open Source Software Systems Integrators * Web Design & Hosting * Internet & Intranet Applications Development * -- Search the list archives before you post http://marc.theaimsgroup.com/?l=php-db -- -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] md5 question!
It's all dependent on the "seed" the first two characters of the hash
You take a password, say "apass" and pass it through md5
Say you get :
dFeRDfss3456fdddsas/..
When the user types in their password, this is what happens
The string above is retrieved, and the password entered, "apass" is run
through md5 WITH THE KNOWN SEED, "dF"
The output of md5 will be
dFeRDfss3456fdddsas/..
and it is compared to what is stored. If they match, hunky-dory, the auth is
granted
Upon creating an md5 hash, the seed is randomly generated, so that two users
with the same password may have completely different hash strings.
Gary Every
Sr. UNIX Administrator
Ingram Entertainment
(615) 287-4876
"Pay It Forward"
mailto:[EMAIL PROTECTED]
http://accessingram.com
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, June 24, 2003 4:47 AM
> To: JeRRy; [EMAIL PROTECTED]
> Subject: Re: [PHP-DB] md5 question!
>
>
> They would be the same, they have to be. If you can de-crypt
> it, there has to
> be some method of validation. So, if someone choose the same
> password as you
> did, and you stored those in a DB as encrypted with md5, then
> they would look
> identical. So, you would know the other person's password.
>
>
>
> > Hi,
> >
> > Hmmm okay... So if the passowrd was.
> >
> > jerry
> >
> > and the md5 output was
> > SKHDJHDJDHJDHSfdfs
> >
> > and another user sets their passowrd to the same as
> > mine does that mean the md5 output would be identical
> > to the last as the same password is entered?
> >
> > e.g.
> >
> > User 1:
> > Username: Fred
> > Password: jerry
> >
> > User 2:
> > Username: notfred
> > Password: jerry
> >
> > Or is each entry unique ?
> >
> > I'm thinking if each entry was unique than reversing
> > the md5 action could be inconclusive. But if the
> > output is the same if the same password is entered
> > than sure it's reliable. But I could be barking up
> > the wrong tree all together here, so correct me if I
> > am wrong. I have not used md5 before so learning on
> > that behalf.
> >
> > Jerry
> >
> > --- [EMAIL PROTECTED] wrote: > Just use brute
> > force...
> > > Example:
> > > md5('password') will ALWAYS produce the same output!
> > > So, if I intercept a pmd5 encrypted password that
> > > looks like: SKHGDOIUYFB
> > > then I could just say:
> > > if (strcmp (md5('password'), SKHGDOIUYFB) == 0)
> > > printf("Your password is: %s\n", password);
> > >
> > > So, just start a loop going through all possible
> > > combinations od legal password
> > > character and encrypt with md5, then compare.
> > >
> > > Hard? Not at all, Time consuming, perhaps, but with
> > > 3+ Ghz processors coming
> > > out you'd be surprised how quickly one could loop
> > > through billlions of possible
> > > password combinations. Enter distributed
> > > environments and it is much fatser.
> > > The key is not to rely on passwords but to rely on
> > > other system security
> > > messures, use SSL, so it is hard to intercept in the
> > > first place, make sure
> > > your system is secure so these passwords cannot be
> > > extracted from your DB
> > > without you knowing about it, etc...
> > >
> > >
> > >
> > > > Marco,
> > > >
> > > > Thanks, that's what I originally thought that it
> > > was
> > > > one way. So websites that have the option to
> > > retrieve
> > > > password don't use md5?
> > > >
> > > > I guess technically there MUST be a way to break
> > > the
> > > > barrier where you can reverse it. If there is a
> > > way
> > > > to make it there is always a way to break it,
> > > somehow.
> > > > But what I have heard and read it's very
> > > tight
> > > > and probably the best method to handle passwords
> > > for
> > > > now, until something new is released. Which will
> > > > happen when md5 is broken, like everything else
> > > after
> > > > a little bit of time.
> > > >
> > > > Jerry
> > > >
> > > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi
> > > > Jerry--
RE: [PHP-DB] md5 question! [CORRECTED]
My mistake -- I'm wrong here. Through a few emails I learned that it is a 32 character hex value that is returned, not a 32 char alphanumeric. That reduces my estimate of 63*10^48 to 340*10^36, still more than crypt though. My bad, sorry to all who believed me without question! Beckman On Tue, 24 Jun 2003, Peter Beckman wrote: > md5 is also a one-way encryption. crypt also provides 300*10^21 possible > values, whereas md5 provides a possible 63*10^48, or > 63000 * 10^21 possible values. A little bit better > security I'd say. Crypt is fine, md5 is better (a lot better by the > numbers). > > The salt doesn't matter -- it is part of the password. > > The first iteration, the salt is 8m. The next one is v9. The first two > chars are the salt used, so the salt really doesn't make things more > secure. If you are storing the crypt value, you have to first select the > value from your DB, get the first two chars (8m for this example) and do > crypt($form['password'], "8m") > in order to get 8m7UxPXfRw7/2 from crypt. > > With md5 you just say "md5($form['password'])" and send it to your select > statement and see what happens. > > To answer your question, md5 is easier and more secure; however, your > system is only as secure as your password, and if your password is > "password" (one of the most popular passwords in the world) md5 nor crypt > nor the best encryption will help you. > > Peter --- Peter Beckman Internet Guy [EMAIL PROTECTED] http://www.purplecow.com/ --- -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] md5 question!
md5 is also a one-way encryption. crypt also provides 300*10^21 possible
values, whereas md5 provides a possible 63*10^48, or
63000 * 10^21 possible values. A little bit better
security I'd say. Crypt is fine, md5 is better (a lot better by the
numbers).
The salt doesn't matter -- it is part of the password.
The first iteration, the salt is 8m. The next one is v9. The first two
chars are the salt used, so the salt really doesn't make things more
secure. If you are storing the crypt value, you have to first select the
value from your DB, get the first two chars (8m for this example) and do
crypt($form['password'], "8m")
in order to get 8m7UxPXfRw7/2 from crypt.
With md5 you just say "md5($form['password'])" and send it to your select
statement and see what happens.
To answer your question, md5 is easier and more secure; however, your
system is only as secure as your password, and if your password is
"password" (one of the most popular passwords in the world) md5 nor crypt
nor the best encryption will help you.
Peter
On Tue, 24 Jun 2003, Hutchins, Richard wrote:
> I already admitted that this stuff was mostly over my head. However, I
> started messing around with it a bit and would like to know if the crypt()
> function would help Jerry out?
>
> I tried md5('password') twice in a row and it did return:
> 5f4dcc3b5aa765d61d8327deb882cf99
> 5f4dcc3b5aa765d61d8327deb882cf99
>
> Then I tried crypt('password') in a 10-step loop and got this:
> 8m7UxPXfRw7/2
> v9iuCQikPaf7w
> MwV8vcCiqrRbM
> lpf02L./2VtiU
> KRkddkPGedm2.
> LDMEpQwJgY.Mo
> 2HW51zTN93I9Y
> hyONnFjRN/9bM
> W9NKVzVgJ9kLM
> nNany7wy2drdQ
>
>
> The code for all of the above if anybody is interested:
>
> echo md5('password')."";
>
> echo md5('password')."";
>
> echo "CRYPT with password";
> for($i=0;$i<10;$i++){
> echo crypt('password')."";
> }
> }
> ?>
>
> PHP.NET states that there is no decrypt function since crypt() is a one-way
> encryption. And given that, by default, it uses a random salt generated by
> PHP, why is this not as secure as an MD5 encrypted password? Of course, all
> of this is based on the supposition that the database is properly secured.
>
> I am, by no means, arguing with any of the advice already offered regarding
> the MD5 question. However, If what you're looking for is a different
> encryption result for the same password, crypt() seems to do it.
>
> Can somebody explain if this is less secure or less-preferable than MD5?
> Even if one were able to decipher the algorithm PHP uses for a crypt()
> operation, the salt is supposedly random so having the encryption algorithm
> would not be all that useful.
>
> Am I totally missing something here?
>
> Rich
>
> > -Original Message-
> > From: Matt Schroebel [mailto:[EMAIL PROTECTED]
> > Sent: Tuesday, June 24, 2003 9:52 AM
> > To: JeRRy
> > Cc: [EMAIL PROTECTED]
> > Subject: RE: [PHP-DB] md5 question!
> >
> >
> >
> >
> > > -Original Message-
> > > From: JeRRy [mailto:[EMAIL PROTECTED]
> > > Sent: Tuesday, June 24, 2003 9:50 AM
> > > To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
> > > Subject: Re: [PHP-DB] md5 question!
> > >
> >
> > > So with md5 I can
> > > retrieve the passwords back to the user if they lose
> > > them via email.
> >
> > No, you can't. You'll need to generate a new password, md5
> > it, store it
> > & mark it expired, timestamp it so it's only valid for, say,
> > 30 minutes,
> > email it, and finally, force the person to choose a new password when
> > they sign in.
> >
> >
> > --
> > PHP Database Mailing List (http://www.php.net/)
> > To unsubscribe, visit: http://www.php.net/unsub.php
> >
>
> --
> PHP Database Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
---
Peter Beckman Internet Guy
[EMAIL PROTECTED] http://www.purplecow.com/
---
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
Most sites save/allow an 8 character password. Allowing alphanumerics and underscore, period and pound (_, ., #), that is 39^8, or 5,352,009,260,481 or about 5 trillion possible passwords. If you allow more than 8 characters, that number increases. On Tue, 24 Jun 2003, Marco Tabini wrote: > On Tue, 2003-06-24 at 09:36, JeRRy wrote: > > Hi, > > > > Hmmm okay... So if the passowrd was. > > > [snip] > > There are ways to avoid this. Typically, you can add a random token (or > a salt) to the password before you calculate its checksum. This way, two > users with the same password will have two different hashes. > > However, a brute-force approach as the one suggested is *not* quite as > simple and powerful as it looks. assuming that there are even just 62 > valid characters for the password (uppercase+lowercase+digits) to go > over passwords as short as five characters you'd have to do 380,204,032 > iterations. Add one more digit and you're already up to 19,770,609,664. > Sure, these are not insurmountable numbers, but they quickly add up with > more and more characters (and I'm not even counting all the > possibilities when it comes to making this more secure). > > Mt. > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > --- Peter Beckman Internet Guy [EMAIL PROTECTED] http://www.purplecow.com/ --- -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
YOU CAN NOT RECOVER THE ORIGINAL TEXT FROM AN MD5 HASH (unless you have a
couple hundred years and nothing to do and want to try all 63*10^48
possibilities).
You can look to see if jerry and bob have the same MD5 hash as their
password, but unless your store their password in plaintext as well as an
md5 hash and you only store the md5 hash, you CANNOT send an email with the
original password. MD5 is one-way encryption.
On Tue, 24 Jun 2003, [iso-8859-1] JeRRy wrote:
> Hi,
>
> Aha... That's what I thought! :) So with md5 I can
> retrieve the passwords back to the user if they lose
> them via email. That's what I was seeking an answer
> to. Thanks so much.
>
> Jerry
>
> --- [EMAIL PROTECTED] wrote: > They would be
> the same, they have to be. If you can
> > de-crypt it, there has to
> > be some method of validation. So, if someone choose
> > the same password as you
> > did, and you stored those in a DB as encrypted with
> > md5, then they would look
> > identical. So, you would know the other person's
> > password.
> >
> >
> >
> > > Hi,
> > >
> > > Hmmm okay... So if the passowrd was.
> > >
> > > jerry
> > >
> > > and the md5 output was
> > > SKHDJHDJDHJDHSfdfs
> > >
> > > and another user sets their passowrd to the same
> > as
> > > mine does that mean the md5 output would be
> > identical
> > > to the last as the same password is entered?
> > >
> > > e.g.
> > >
> > > User 1:
> > > Username: Fred
> > > Password: jerry
> > >
> > > User 2:
> > > Username: notfred
> > > Password: jerry
> > >
> > > Or is each entry unique ?
> > >
> > > I'm thinking if each entry was unique than
> > reversing
> > > the md5 action could be inconclusive. But if the
> > > output is the same if the same password is entered
> > > than sure it's reliable. But I could be barking
> > up
> > > the wrong tree all together here, so correct me if
> > I
> > > am wrong. I have not used md5 before so learning
> > on
> > > that behalf.
> > >
> > > Jerry
> > >
> > > --- [EMAIL PROTECTED] wrote: > Just use
> > brute
> > > force...
> > > > Example:
> > > > md5('password') will ALWAYS produce the same
> > output!
> > > > So, if I intercept a pmd5 encrypted password
> > that
> > > > looks like: SKHGDOIUYFB
> > > > then I could just say:
> > > > if (strcmp (md5('password'), SKHGDOIUYFB) == 0)
> > > > printf("Your password is: %s\n", password);
> > > >
> > > > So, just start a loop going through all possible
> > > > combinations od legal password
> > > > character and encrypt with md5, then compare.
> > > >
> > > > Hard? Not at all, Time consuming, perhaps, but
> > with
> > > > 3+ Ghz processors coming
> > > > out you'd be surprised how quickly one could
> > loop
> > > > through billlions of possible
> > > > password combinations. Enter distributed
> > > > environments and it is much fatser.
> > > > The key is not to rely on passwords but to rely
> > on
> > > > other system security
> > > > messures, use SSL, so it is hard to intercept in
> > the
> > > > first place, make sure
> > > > your system is secure so these passwords cannot
> > be
> > > > extracted from your DB
> > > > without you knowing about it, etc...
> > > >
> > > >
> > > >
> > > > > Marco,
> > > > >
> > > > > Thanks, that's what I originally thought that
> > it
> > > > was
> > > > > one way. So websites that have the option to
> > > > retrieve
> > > > > password don't use md5?
> > > > >
> > > > > I guess technically there MUST be a way to
> > break
> > > > the
> > > > > barrier where you can reverse it. If there is
> > a
> > > > way
> > > > > to make it there is always a way to break it,
> > > > somehow.
> > > > > But what I have heard and read it's
> > very
> > > > tight
> > > > > and probably the best method to handle
> > passwords
> > > > for
> > > > > now, until something new is released. Which
> > will
> > > > > happen when md5 is broken, like everything
> > else
> > > > after
> > > > > a little bit of time.
> > > > >
> > > > > Jerry
> > > > >
> > > > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: >
> > Hi
> > > > > Jerry--
> > > > > >
> > > > > > No, md5 is a one-way hash. That's why it's
> > so
> > > > > > safe--because if someone
> > > > > > steals the information he still can't tell
> > what
> > > > the
> > > > > > passwords are.
> > > > > >
> > > > > > You may want to reset the passwords upon
> > your
> > > > users'
> > > > > > request and send it
> > > > > > to them via e-mail instead.
> > > > > >
> > > > > > Cheers,
> > > > > >
> > > > > >
> > > > > > Marco
> > > > > >
> > > > > > --
> > > > > > php|architect -- The Magazine for PHP
> > > > Professionals
> > > > > > Come try us out at http://www.phparch.com
> > and
> > > > get a
> > > > > > free trial issue
> > > > > >
> > > > > >
> > > > > > On Tue, 2003-06-24 at 08:35, JeRRy wrote:
> > > > > > > Hi,
> > > > > > >
> > > > > > > If I use md5 to handle passwords to my
> > > > database is
> > > > > > > there a way to reverse the action if
> > someone
> > > > > > forgets
> > > > > > > their password?
RE: [PHP-DB] md5 question!
Sure, but only the first eight characters of the password are actually
used to make the hash (IIRC).
Marco
On Tue, 2003-06-24 at 10:15, Hutchins, Richard wrote:
> I already admitted that this stuff was mostly over my head. However, I
> started messing around with it a bit and would like to know if the crypt()
> function would help Jerry out?
>
> I tried md5('password') twice in a row and it did return:
> 5f4dcc3b5aa765d61d8327deb882cf99
> 5f4dcc3b5aa765d61d8327deb882cf99
>
> Then I tried crypt('password') in a 10-step loop and got this:
> 8m7UxPXfRw7/2
> v9iuCQikPaf7w
> MwV8vcCiqrRbM
> lpf02L./2VtiU
> KRkddkPGedm2.
> LDMEpQwJgY.Mo
> 2HW51zTN93I9Y
> hyONnFjRN/9bM
> W9NKVzVgJ9kLM
> nNany7wy2drdQ
>
>
> The code for all of the above if anybody is interested:
>
> echo md5('password')."";
>
> echo md5('password')."";
>
> echo "CRYPT with password";
> for($i=0;$i<10;$i++){
> echo crypt('password')."";
> }
> }
> ?>
>
> PHP.NET states that there is no decrypt function since crypt() is a one-way
> encryption. And given that, by default, it uses a random salt generated by
> PHP, why is this not as secure as an MD5 encrypted password? Of course, all
> of this is based on the supposition that the database is properly secured.
>
> I am, by no means, arguing with any of the advice already offered regarding
> the MD5 question. However, If what you're looking for is a different
> encryption result for the same password, crypt() seems to do it.
>
> Can somebody explain if this is less secure or less-preferable than MD5?
> Even if one were able to decipher the algorithm PHP uses for a crypt()
> operation, the salt is supposedly random so having the encryption algorithm
> would not be all that useful.
>
> Am I totally missing something here?
>
> Rich
>
> > -Original Message-
> > From: Matt Schroebel [mailto:[EMAIL PROTECTED]
> > Sent: Tuesday, June 24, 2003 9:52 AM
> > To: JeRRy
> > Cc: [EMAIL PROTECTED]
> > Subject: RE: [PHP-DB] md5 question!
> >
> >
> >
> >
> > > -Original Message-
> > > From: JeRRy [mailto:[EMAIL PROTECTED]
> > > Sent: Tuesday, June 24, 2003 9:50 AM
> > > To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
> > > Subject: Re: [PHP-DB] md5 question!
> > >
> >
> > > So with md5 I can
> > > retrieve the passwords back to the user if they lose
> > > them via email.
> >
> > No, you can't. You'll need to generate a new password, md5
> > it, store it
> > & mark it expired, timestamp it so it's only valid for, say,
> > 30 minutes,
> > email it, and finally, force the person to choose a new password when
> > they sign in.
> >
> >
> > --
> > PHP Database Mailing List (http://www.php.net/)
> > To unsubscribe, visit: http://www.php.net/unsub.php
> >
--
Marco Tabini
President
Marco Tabini & Associates, Inc.
28 Bombay Avenue
Toronto, ON M3H 1B7
Canada
Phone: (416) 630-6202
Fax: (416) 630-5057
Web: http://www.tabini.ca
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] md5 question!
I already admitted that this stuff was mostly over my head. However, I
started messing around with it a bit and would like to know if the crypt()
function would help Jerry out?
I tried md5('password') twice in a row and it did return:
5f4dcc3b5aa765d61d8327deb882cf99
5f4dcc3b5aa765d61d8327deb882cf99
Then I tried crypt('password') in a 10-step loop and got this:
8m7UxPXfRw7/2
v9iuCQikPaf7w
MwV8vcCiqrRbM
lpf02L./2VtiU
KRkddkPGedm2.
LDMEpQwJgY.Mo
2HW51zTN93I9Y
hyONnFjRN/9bM
W9NKVzVgJ9kLM
nNany7wy2drdQ
The code for all of the above if anybody is interested:
";
echo md5('password')."";
echo "CRYPT with password";
for($i=0;$i<10;$i++){
echo crypt('password')."";
}
}
?>
PHP.NET states that there is no decrypt function since crypt() is a one-way
encryption. And given that, by default, it uses a random salt generated by
PHP, why is this not as secure as an MD5 encrypted password? Of course, all
of this is based on the supposition that the database is properly secured.
I am, by no means, arguing with any of the advice already offered regarding
the MD5 question. However, If what you're looking for is a different
encryption result for the same password, crypt() seems to do it.
Can somebody explain if this is less secure or less-preferable than MD5?
Even if one were able to decipher the algorithm PHP uses for a crypt()
operation, the salt is supposedly random so having the encryption algorithm
would not be all that useful.
Am I totally missing something here?
Rich
> -Original Message-
> From: Matt Schroebel [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, June 24, 2003 9:52 AM
> To: JeRRy
> Cc: [EMAIL PROTECTED]
> Subject: RE: [PHP-DB] md5 question!
>
>
>
>
> > -Original Message-
> > From: JeRRy [mailto:[EMAIL PROTECTED]
> > Sent: Tuesday, June 24, 2003 9:50 AM
> > To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
> > Subject: Re: [PHP-DB] md5 question!
> >
>
> > So with md5 I can
> > retrieve the passwords back to the user if they lose
> > them via email.
>
> No, you can't. You'll need to generate a new password, md5
> it, store it
> & mark it expired, timestamp it so it's only valid for, say,
> 30 minutes,
> email it, and finally, force the person to choose a new password when
> they sign in.
>
>
> --
> PHP Database Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] md5 question!
> -Original Message- > From: JeRRy [mailto:[EMAIL PROTECTED] > Sent: Tuesday, June 24, 2003 9:50 AM > To: [EMAIL PROTECTED]; [EMAIL PROTECTED] > Subject: Re: [PHP-DB] md5 question! > > So with md5 I can > retrieve the passwords back to the user if they lose > them via email. No, you can't. You'll need to generate a new password, md5 it, store it & mark it expired, timestamp it so it's only valid for, say, 30 minutes, email it, and finally, force the person to choose a new password when they sign in. -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
Marco, Aha... Thanks. I guess there is no need to add a salt if I'm the only admin using the database interface. But I guess if you want to be more secure etc it would be best to add it so if someone grabbed the database they will find no matches. I really have to look into making my databases more secure than they already are. Any good websites that is good reading for this? I mean reliable sites with no bull ***rubbish*** which does not send on the wrong messages. Jerry --- Marco Tabini <[EMAIL PROTECTED]> wrote: > On Tue, 2003-06-24 at 09:36, JeRRy wrote: > > Hi, > > > > Hmmm okay... So if the passowrd was. > > > [snip] > > There are ways to avoid this. Typically, you can add > a random token (or > a salt) to the password before you calculate its > checksum. This way, two > users with the same password will have two different > hashes. > > However, a brute-force approach as the one suggested > is *not* quite as > simple and powerful as it looks. assuming that there > are even just 62 > valid characters for the password > (uppercase+lowercase+digits) to go > over passwords as short as five characters you'd > have to do 380,204,032 > iterations. Add one more digit and you're already up > to 19,770,609,664. > Sure, these are not insurmountable numbers, but they > quickly add up with > more and more characters (and I'm not even counting > all the > possibilities when it comes to making this more > secure). > > Mt. > http://mobile.yahoo.com.au - Yahoo! Mobile - Check & compose your email via SMS on your Telstra or Vodafone mobile. -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] md5 question!
md5() will always return the same for the same string, how else can you verify that the user entered their password? everytime they log in, you have to encrypt what they typed in $pword=md5($pword); select * from users where uname='$uname' and pword='$pword' and see if it matches the password they registered with, if md5() gave you different output, then you could never verify thier password. Eddie -Original Message- From: JeRRy [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 24, 2003 9:45 AM To: Marco Tabini Cc: [EMAIL PROTECTED] Subject: Re: [PHP-DB] md5 question! Marco, Okay I just replied to another post asking if md5 outputs a different output if the same password was entered by more than 1 user. I think the answer to that is explained by you below. If true, if more than 1 user had an identical password to another the md5 output would be unique for each user. So a different md5 output even though the same password. Because if: it's mathematically impossible to retrieve > the original > password starting from the hash... which is a Good > Thing(tm) :-) ... is true than a different md5 output must be outputed for each password even if it's the same as another. Because if it was "the same" md5 output it would than be possible to reverse the md5 back to plain text? Well I woudl think so, because it's the same. I just recieved an email to my inbox saying there is a way to reverse it. So I really have no idea what to think, instead I'm going to give the examples I have recieved a go and see what happens. Thanks everyone for your help/feedback/ideas and code on this subject, it's been overwhelming. Very much appreciated. Jerry --- Marco Tabini <[EMAIL PROTECTED]> wrote: > On Tue, 2003-06-24 at 09:08, JeRRy wrote: > > I guess technically there MUST be a way to break > the > > barrier where you can reverse it. If there is a > way > > to make it there is always a way to break it, > somehow. > > But what I have heard and read it's very > tight > > and probably the best method to handle passwords > for > > now, until something new is released. Which will > > happen when md5 is broken, like everything else > after > > a little bit of time. > > Well, that's not necessarily true. Take something as > simple as an > integer division. Say that in order calculate your > hash you divide any > number by 3 and discard the remainder. The result > '4' could mean that > your original number could be anywhere between 12 > and 14, for example, > so that even if you know that method that was used > to calculate the hash > you couldn't determine the original password from > it. md5 works on a > similar basis, although a bit (but not that much) > more complicated. So > you see, it's mathematically impossible to retrieve > the original > password starting from the hash... which is a Good > Thing(tm) :-) > > > Marco > > -- > php|architect -- The Magazine for PHP Professionals > Come try us out at http://www.phparch.com and get a > free trial issue > > > > > > > Jerry > > > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi > > Jerry-- > > > > > > No, md5 is a one-way hash. That's why it's so > > > safe--because if someone > > > steals the information he still can't tell what > the > > > passwords are. > > > > > > You may want to reset the passwords upon your > users' > > > request and send it > > > to them via e-mail instead. > > > > > > Cheers, > > > > > > > > > Marco > > > > > > -- > > > php|architect -- The Magazine for PHP > Professionals > > > Come try us out at http://www.phparch.com and > get a > > > free trial issue > > > > > > > > > On Tue, 2003-06-24 at 08:35, JeRRy wrote: > > > > Hi, > > > > > > > > If I use md5 to handle passwords to my > database is > > > > there a way to reverse the action if someone > > > forgets > > > > their password? Is there a way for me to > decode > > > the > > > > 32bit to plain text? > > > > > > > > Jerry > > > > > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > > > > - Check & compose your email via SMS on your > > > Telstra or Vodafone mobile. > > > -- > > > > > > Marco Tabini > > > President > > > > > > Marco Tabini & Associates, Inc. > > > 28 Bombay Avenue > > > Toronto, ON M3H 1B7 &g
Re: [PHP-DB] md5 question!
On Tue, 2003-06-24 at 09:45, JeRRy wrote: > If true, if more than 1 user had an identical password > to another the md5 output would be unique for each > user. So a different md5 output even though the same > password. Because if: > > > it's mathematically impossible to retrieve > > the original > > password starting from the hash... which is a Good > > Thing(tm) :-) > > > ... is true than a different md5 output must be > outputed for each password even if it's the same as > another. Because if it was "the same" md5 output it > would than be possible to reverse the md5 back to > plain text? Well I woudl think so, because it's the > same. No, these are two unrelated concepts, in fact they contradict each other. If two passwords *can* have the same hash (which is well possible), then you can't tell the password from the hash. > I just recieved an email to my inbox saying there is a > way to reverse it. So I really have no idea what to > think, instead I'm going to give the examples I have > recieved a go and see what happens. Well, I haven't heard of md5 being broken, although it's been claimed that it is breakable. I'd love to see the references they have sent you! Cheers, Marco > > Thanks everyone for your help/feedback/ideas and code > on this subject, it's been overwhelming. Very much > appreciated. > > Jerry > > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > On Tue, > 2003-06-24 at 09:08, JeRRy wrote: > > > I guess technically there MUST be a way to break > > the > > > barrier where you can reverse it. If there is a > > way > > > to make it there is always a way to break it, > > somehow. > > > But what I have heard and read it's very > > tight > > > and probably the best method to handle passwords > > for > > > now, until something new is released. Which will > > > happen when md5 is broken, like everything else > > after > > > a little bit of time. > > > > Well, that's not necessarily true. Take something as > > simple as an > > integer division. Say that in order calculate your > > hash you divide any > > number by 3 and discard the remainder. The result > > '4' could mean that > > your original number could be anywhere between 12 > > and 14, for example, > > so that even if you know that method that was used > > to calculate the hash > > you couldn't determine the original password from > > it. md5 works on a > > similar basis, although a bit (but not that much) > > more complicated. So > > you see, it's mathematically impossible to retrieve > > the original > > password starting from the hash... which is a Good > > Thing(tm) :-) > > > > > > Marco > > > > -- > > php|architect -- The Magazine for PHP Professionals > > Come try us out at http://www.phparch.com and get a > > free trial issue > > > > > > > > > > > Jerry > > > > > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi > > > Jerry-- > > > > > > > > No, md5 is a one-way hash. That's why it's so > > > > safe--because if someone > > > > steals the information he still can't tell what > > the > > > > passwords are. > > > > > > > > You may want to reset the passwords upon your > > users' > > > > request and send it > > > > to them via e-mail instead. > > > > > > > > Cheers, > > > > > > > > > > > > Marco > > > > > > > > -- > > > > php|architect -- The Magazine for PHP > > Professionals > > > > Come try us out at http://www.phparch.com and > > get a > > > > free trial issue > > > > > > > > > > > > On Tue, 2003-06-24 at 08:35, JeRRy wrote: > > > > > Hi, > > > > > > > > > > If I use md5 to handle passwords to my > > database is > > > > > there a way to reverse the action if someone > > > > forgets > > > > > their password? Is there a way for me to > > decode > > > > the > > > > > 32bit to plain text? > > > > > > > > > > Jerry > > > > > > > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > > > > > - Check & compose your email via SMS on your > > > > Telstra or Vodafone mobile. > > > > -- > > > > > > > > Marco Tabini > > > > President > > > > > > > > Marco Tabini & Associates, Inc. > > > > 28 Bombay Avenue > > > > Toronto, ON M3H 1B7 > > > > Canada > > > > > > > > Phone: (416) 630-6202 > > > > Fax: (416) 630-5057 > > > > Web: http://www.tabini.ca > > > > > > > > > > > > -- > > > > PHP Database Mailing List (http://www.php.net/) > > > > To unsubscribe, visit: > > http://www.php.net/unsub.php > > > > > > > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > > > - Check & compose your email via SMS on your > > Telstra or Vodafone mobile. > > -- > > > > Marco Tabini > > President > > > > Marco Tabini & Associates, Inc. > > 28 Bombay Avenue > > Toronto, ON M3H 1B7 > > Canada > > > > Phone: (416) 630-6202 > > Fax: (416) 630-5057 > > Web: http://www.tabini.ca > > > > > > -- > > PHP Database Mailing List (http://www.php.net/) > > To unsubscribe, visit: http://www.php.net/unsub.php > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > - Check & compose your email via SMS on your Telstra or Vo
Re: [PHP-DB] md5 question!
Hi,
Aha... That's what I thought! :) So with md5 I can
retrieve the passwords back to the user if they lose
them via email. That's what I was seeking an answer
to. Thanks so much.
Jerry
--- [EMAIL PROTECTED] wrote: > They would be
the same, they have to be. If you can
> de-crypt it, there has to
> be some method of validation. So, if someone choose
> the same password as you
> did, and you stored those in a DB as encrypted with
> md5, then they would look
> identical. So, you would know the other person's
> password.
>
>
>
> > Hi,
> >
> > Hmmm okay... So if the passowrd was.
> >
> > jerry
> >
> > and the md5 output was
> > SKHDJHDJDHJDHSfdfs
> >
> > and another user sets their passowrd to the same
> as
> > mine does that mean the md5 output would be
> identical
> > to the last as the same password is entered?
> >
> > e.g.
> >
> > User 1:
> > Username: Fred
> > Password: jerry
> >
> > User 2:
> > Username: notfred
> > Password: jerry
> >
> > Or is each entry unique ?
> >
> > I'm thinking if each entry was unique than
> reversing
> > the md5 action could be inconclusive. But if the
> > output is the same if the same password is entered
> > than sure it's reliable. But I could be barking
> up
> > the wrong tree all together here, so correct me if
> I
> > am wrong. I have not used md5 before so learning
> on
> > that behalf.
> >
> > Jerry
> >
> > --- [EMAIL PROTECTED] wrote: > Just use
> brute
> > force...
> > > Example:
> > > md5('password') will ALWAYS produce the same
> output!
> > > So, if I intercept a pmd5 encrypted password
> that
> > > looks like: SKHGDOIUYFB
> > > then I could just say:
> > > if (strcmp (md5('password'), SKHGDOIUYFB) == 0)
> > > printf("Your password is: %s\n", password);
> > >
> > > So, just start a loop going through all possible
> > > combinations od legal password
> > > character and encrypt with md5, then compare.
> > >
> > > Hard? Not at all, Time consuming, perhaps, but
> with
> > > 3+ Ghz processors coming
> > > out you'd be surprised how quickly one could
> loop
> > > through billlions of possible
> > > password combinations. Enter distributed
> > > environments and it is much fatser.
> > > The key is not to rely on passwords but to rely
> on
> > > other system security
> > > messures, use SSL, so it is hard to intercept in
> the
> > > first place, make sure
> > > your system is secure so these passwords cannot
> be
> > > extracted from your DB
> > > without you knowing about it, etc...
> > >
> > >
> > >
> > > > Marco,
> > > >
> > > > Thanks, that's what I originally thought that
> it
> > > was
> > > > one way. So websites that have the option to
> > > retrieve
> > > > password don't use md5?
> > > >
> > > > I guess technically there MUST be a way to
> break
> > > the
> > > > barrier where you can reverse it. If there is
> a
> > > way
> > > > to make it there is always a way to break it,
> > > somehow.
> > > > But what I have heard and read it's
> very
> > > tight
> > > > and probably the best method to handle
> passwords
> > > for
> > > > now, until something new is released. Which
> will
> > > > happen when md5 is broken, like everything
> else
> > > after
> > > > a little bit of time.
> > > >
> > > > Jerry
> > > >
> > > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: >
> Hi
> > > > Jerry--
> > > > >
> > > > > No, md5 is a one-way hash. That's why it's
> so
> > > > > safe--because if someone
> > > > > steals the information he still can't tell
> what
> > > the
> > > > > passwords are.
> > > > >
> > > > > You may want to reset the passwords upon
> your
> > > users'
> > > > > request and send it
> > > > > to them via e-mail instead.
> > > > >
> > > > > Cheers,
> > > > >
> > > > >
> > > > > Marco
> > > > >
> > > > > --
> > > > > php|architect -- The Magazine for PHP
> > > Professionals
> > > > > Come try us out at http://www.phparch.com
> and
> > > get a
> > > > > free trial issue
> > > > >
> > > > >
> > > > > On Tue, 2003-06-24 at 08:35, JeRRy wrote:
> > > > > > Hi,
> > > > > >
> > > > > > If I use md5 to handle passwords to my
> > > database is
> > > > > > there a way to reverse the action if
> someone
> > > > > forgets
> > > > > > their password? Is there a way for me to
> > > decode
> > > > > the
> > > > > > 32bit to plain text?
> > > > > >
> > > > > > Jerry
> > > > > >
> > > > > > http://mobile.yahoo.com.au - Yahoo! Mobile
> > > > > > - Check & compose your email via SMS on
> your
> > > > > Telstra or Vodafone mobile.
> > > > > --
> > > > >
> > > > > Marco Tabini
> > > > > President
> > > > >
> > > > > Marco Tabini & Associates, Inc.
> > > > > 28 Bombay Avenue
> > > > > Toronto, ON M3H 1B7
> > > > > Canada
> > > > >
> > > > > Phone: (416) 630-6202
> > > > > Fax: (416) 630-5057
> > > > > Web: http://www.tabini.ca
> > > > >
> > > > >
> > > > > --
> > > > > PHP Database Mailing List
> (http://www.php.net/)
> > > > > To unsubscribe, visit:
> > > http://www.php.net/unsub.php
> > > > >
> > > >
Re: [PHP-DB] md5 question!
On Tue, 2003-06-24 at 09:36, JeRRy wrote: > Hi, > > Hmmm okay... So if the passowrd was. > [snip] There are ways to avoid this. Typically, you can add a random token (or a salt) to the password before you calculate its checksum. This way, two users with the same password will have two different hashes. However, a brute-force approach as the one suggested is *not* quite as simple and powerful as it looks. assuming that there are even just 62 valid characters for the password (uppercase+lowercase+digits) to go over passwords as short as five characters you'd have to do 380,204,032 iterations. Add one more digit and you're already up to 19,770,609,664. Sure, these are not insurmountable numbers, but they quickly add up with more and more characters (and I'm not even counting all the possibilities when it comes to making this more secure). Mt. -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
They would be the same, they have to be. If you can de-crypt it, there has to
be some method of validation. So, if someone choose the same password as you
did, and you stored those in a DB as encrypted with md5, then they would look
identical. So, you would know the other person's password.
> Hi,
>
> Hmmm okay... So if the passowrd was.
>
> jerry
>
> and the md5 output was
> SKHDJHDJDHJDHSfdfs
>
> and another user sets their passowrd to the same as
> mine does that mean the md5 output would be identical
> to the last as the same password is entered?
>
> e.g.
>
> User 1:
> Username: Fred
> Password: jerry
>
> User 2:
> Username: notfred
> Password: jerry
>
> Or is each entry unique ?
>
> I'm thinking if each entry was unique than reversing
> the md5 action could be inconclusive. But if the
> output is the same if the same password is entered
> than sure it's reliable. But I could be barking up
> the wrong tree all together here, so correct me if I
> am wrong. I have not used md5 before so learning on
> that behalf.
>
> Jerry
>
> --- [EMAIL PROTECTED] wrote: > Just use brute
> force...
> > Example:
> > md5('password') will ALWAYS produce the same output!
> > So, if I intercept a pmd5 encrypted password that
> > looks like: SKHGDOIUYFB
> > then I could just say:
> > if (strcmp (md5('password'), SKHGDOIUYFB) == 0)
> > printf("Your password is: %s\n", password);
> >
> > So, just start a loop going through all possible
> > combinations od legal password
> > character and encrypt with md5, then compare.
> >
> > Hard? Not at all, Time consuming, perhaps, but with
> > 3+ Ghz processors coming
> > out you'd be surprised how quickly one could loop
> > through billlions of possible
> > password combinations. Enter distributed
> > environments and it is much fatser.
> > The key is not to rely on passwords but to rely on
> > other system security
> > messures, use SSL, so it is hard to intercept in the
> > first place, make sure
> > your system is secure so these passwords cannot be
> > extracted from your DB
> > without you knowing about it, etc...
> >
> >
> >
> > > Marco,
> > >
> > > Thanks, that's what I originally thought that it
> > was
> > > one way. So websites that have the option to
> > retrieve
> > > password don't use md5?
> > >
> > > I guess technically there MUST be a way to break
> > the
> > > barrier where you can reverse it. If there is a
> > way
> > > to make it there is always a way to break it,
> > somehow.
> > > But what I have heard and read it's very
> > tight
> > > and probably the best method to handle passwords
> > for
> > > now, until something new is released. Which will
> > > happen when md5 is broken, like everything else
> > after
> > > a little bit of time.
> > >
> > > Jerry
> > >
> > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi
> > > Jerry--
> > > >
> > > > No, md5 is a one-way hash. That's why it's so
> > > > safe--because if someone
> > > > steals the information he still can't tell what
> > the
> > > > passwords are.
> > > >
> > > > You may want to reset the passwords upon your
> > users'
> > > > request and send it
> > > > to them via e-mail instead.
> > > >
> > > > Cheers,
> > > >
> > > >
> > > > Marco
> > > >
> > > > --
> > > > php|architect -- The Magazine for PHP
> > Professionals
> > > > Come try us out at http://www.phparch.com and
> > get a
> > > > free trial issue
> > > >
> > > >
> > > > On Tue, 2003-06-24 at 08:35, JeRRy wrote:
> > > > > Hi,
> > > > >
> > > > > If I use md5 to handle passwords to my
> > database is
> > > > > there a way to reverse the action if someone
> > > > forgets
> > > > > their password? Is there a way for me to
> > decode
> > > > the
> > > > > 32bit to plain text?
> > > > >
> > > > > Jerry
> > > > >
> > > > > http://mobile.yahoo.com.au - Yahoo! Mobile
> > > > > - Check & compose your email via SMS on your
> > > > Telstra or Vodafone mobile.
> > > > --
> > > >
> > > > Marco Tabini
> > > > President
> > > >
> > > > Marco Tabini & Associates, Inc.
> > > > 28 Bombay Avenue
> > > > Toronto, ON M3H 1B7
> > > > Canada
> > > >
> > > > Phone: (416) 630-6202
> > > > Fax: (416) 630-5057
> > > > Web: http://www.tabini.ca
> > > >
> > > >
> > > > --
> > > > PHP Database Mailing List (http://www.php.net/)
> > > > To unsubscribe, visit:
> > http://www.php.net/unsub.php
> > > >
> > >
> > > http://mobile.yahoo.com.au - Yahoo! Mobile
> > > - Check & compose your email via SMS on your
> > Telstra or Vodafone mobile.
> > >
> > > --
> > > PHP Database Mailing List (http://www.php.net/)
> > > To unsubscribe, visit:
> > http://www.php.net/unsub.php
> > >
> >
> >
> >
> >
>
> http://mobile.yahoo.com.au - Yahoo! Mobile
> - Check & compose your email via SMS on your Telstra or Vodafone mobile.
>
> --
> PHP Database Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit:
Re: [PHP-DB] md5 question!
Marco, Okay I just replied to another post asking if md5 outputs a different output if the same password was entered by more than 1 user. I think the answer to that is explained by you below. If true, if more than 1 user had an identical password to another the md5 output would be unique for each user. So a different md5 output even though the same password. Because if: it's mathematically impossible to retrieve > the original > password starting from the hash... which is a Good > Thing(tm) :-) ... is true than a different md5 output must be outputed for each password even if it's the same as another. Because if it was "the same" md5 output it would than be possible to reverse the md5 back to plain text? Well I woudl think so, because it's the same. I just recieved an email to my inbox saying there is a way to reverse it. So I really have no idea what to think, instead I'm going to give the examples I have recieved a go and see what happens. Thanks everyone for your help/feedback/ideas and code on this subject, it's been overwhelming. Very much appreciated. Jerry --- Marco Tabini <[EMAIL PROTECTED]> wrote: > On Tue, 2003-06-24 at 09:08, JeRRy wrote: > > I guess technically there MUST be a way to break > the > > barrier where you can reverse it. If there is a > way > > to make it there is always a way to break it, > somehow. > > But what I have heard and read it's very > tight > > and probably the best method to handle passwords > for > > now, until something new is released. Which will > > happen when md5 is broken, like everything else > after > > a little bit of time. > > Well, that's not necessarily true. Take something as > simple as an > integer division. Say that in order calculate your > hash you divide any > number by 3 and discard the remainder. The result > '4' could mean that > your original number could be anywhere between 12 > and 14, for example, > so that even if you know that method that was used > to calculate the hash > you couldn't determine the original password from > it. md5 works on a > similar basis, although a bit (but not that much) > more complicated. So > you see, it's mathematically impossible to retrieve > the original > password starting from the hash... which is a Good > Thing(tm) :-) > > > Marco > > -- > php|architect -- The Magazine for PHP Professionals > Come try us out at http://www.phparch.com and get a > free trial issue > > > > > > > Jerry > > > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi > > Jerry-- > > > > > > No, md5 is a one-way hash. That's why it's so > > > safe--because if someone > > > steals the information he still can't tell what > the > > > passwords are. > > > > > > You may want to reset the passwords upon your > users' > > > request and send it > > > to them via e-mail instead. > > > > > > Cheers, > > > > > > > > > Marco > > > > > > -- > > > php|architect -- The Magazine for PHP > Professionals > > > Come try us out at http://www.phparch.com and > get a > > > free trial issue > > > > > > > > > On Tue, 2003-06-24 at 08:35, JeRRy wrote: > > > > Hi, > > > > > > > > If I use md5 to handle passwords to my > database is > > > > there a way to reverse the action if someone > > > forgets > > > > their password? Is there a way for me to > decode > > > the > > > > 32bit to plain text? > > > > > > > > Jerry > > > > > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > > > > - Check & compose your email via SMS on your > > > Telstra or Vodafone mobile. > > > -- > > > > > > Marco Tabini > > > President > > > > > > Marco Tabini & Associates, Inc. > > > 28 Bombay Avenue > > > Toronto, ON M3H 1B7 > > > Canada > > > > > > Phone: (416) 630-6202 > > > Fax: (416) 630-5057 > > > Web: http://www.tabini.ca > > > > > > > > > -- > > > PHP Database Mailing List (http://www.php.net/) > > > To unsubscribe, visit: > http://www.php.net/unsub.php > > > > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > > - Check & compose your email via SMS on your > Telstra or Vodafone mobile. > -- > > Marco Tabini > President > > Marco Tabini & Associates, Inc. > 28 Bombay Avenue > Toronto, ON M3H 1B7 > Canada > > Phone: (416) 630-6202 > Fax: (416) 630-5057 > Web: http://www.tabini.ca > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > http://mobile.yahoo.com.au - Yahoo! Mobile - Check & compose your email via SMS on your Telstra or Vodafone mobile. -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
md5 returns a 32 char hexdec string. I'm not sure where you get an 11
char alpha string from md5...
Since the MD5 is 32 chars in length, with 36 possibilities for each char,
that leaves us with 36^32, or 63340286662973277706162286946811886609896461828096
or 63,340,286,662,973,276,904,018,768,749,012,366,609,829,142,200,320 after
using number_format. What is that? A little more than the billions of
possibilities you suggest would exist... Hmmm, that's 63 quindecillion, or
like 63 * 10^48. Ouch. I think even with 3+ Ghz processors you might have
to wait a few years. Months? Maybe distributed, but doubtful. Given that
it took 4 years to go through 15,769,938,165,961,326,592 keys (out of a
possible 18,446,744,073,709,551,616) to break 64
bit RSA encryption. Thats 18 * 10^18 total possible keys. That's a lot
less than 63 * 10^48 and it took 4 years and 331,000 computers.
http://www.pcw.co.uk/News/1135452
>From the PHP manual:
http://php.net/md5
Calculates the MD5 hash of str using the RSA Data Security, Inc. MD5
Message-Digest Algorithm, and returns that hash. The hash is a 32-character
hexadecimal number. If the optional raw_output is set to TRUE, then the md5
digest is instead returned in raw binary format with a length of 16.
Beckman
On Tue, 24 Jun 2003 [EMAIL PROTECTED] wrote:
> Just use brute force...
> Example:
> md5('password') will ALWAYS produce the same output!
> So, if I intercept a pmd5 encrypted password that looks like: SKHGDOIUYFB
> then I could just say:
> if (strcmp (md5('password'), SKHGDOIUYFB) == 0)
> printf("Your password is: %s\n", password);
>
> So, just start a loop going through all possible combinations od legal password
> character and encrypt with md5, then compare.
>
> Hard? Not at all, Time consuming, perhaps, but with 3+ Ghz processors coming
> out you'd be surprised how quickly one could loop through billlions of possible
> password combinations. Enter distributed environments and it is much fatser.
> The key is not to rely on passwords but to rely on other system security
> messures, use SSL, so it is hard to intercept in the first place, make sure
> your system is secure so these passwords cannot be extracted from your DB
> without you knowing about it, etc...
>
>
>
> > Marco,
> >
> > Thanks, that's what I originally thought that it was
> > one way. So websites that have the option to retrieve
> > password don't use md5?
> >
> > I guess technically there MUST be a way to break the
> > barrier where you can reverse it. If there is a way
> > to make it there is always a way to break it, somehow.
> > But what I have heard and read it's very tight
> > and probably the best method to handle passwords for
> > now, until something new is released. Which will
> > happen when md5 is broken, like everything else after
> > a little bit of time.
> >
> > Jerry
> >
> > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi
> > Jerry--
> > >
> > > No, md5 is a one-way hash. That's why it's so
> > > safe--because if someone
> > > steals the information he still can't tell what the
> > > passwords are.
> > >
> > > You may want to reset the passwords upon your users'
> > > request and send it
> > > to them via e-mail instead.
> > >
> > > Cheers,
> > >
> > >
> > > Marco
> > >
> > > --
> > > php|architect -- The Magazine for PHP Professionals
> > > Come try us out at http://www.phparch.com and get a
> > > free trial issue
> > >
> > >
> > > On Tue, 2003-06-24 at 08:35, JeRRy wrote:
> > > > Hi,
> > > >
> > > > If I use md5 to handle passwords to my database is
> > > > there a way to reverse the action if someone
> > > forgets
> > > > their password? Is there a way for me to decode
> > > the
> > > > 32bit to plain text?
> > > >
> > > > Jerry
> > > >
> > > > http://mobile.yahoo.com.au - Yahoo! Mobile
> > > > - Check & compose your email via SMS on your
> > > Telstra or Vodafone mobile.
> > > --
> > >
> > > Marco Tabini
> > > President
> > >
> > > Marco Tabini & Associates, Inc.
> > > 28 Bombay Avenue
> > > Toronto, ON M3H 1B7
> > > Canada
> > >
> > > Phone: (416) 630-6202
> > > Fax: (416) 630-5057
> > > Web: http://www.tabini.ca
> > >
> > >
> > > --
> > > PHP Database Mailing List (http://www.php.net/)
> > > To unsubscribe, visit: http://www.php.net/unsub.php
> > >
> >
> > http://mobile.yahoo.com.au - Yahoo! Mobile
> > - Check & compose your email via SMS on your Telstra or Vodafone mobile.
> >
> > --
> > PHP Database Mailing List (http://www.php.net/)
> > To unsubscribe, visit: http://www.php.net/unsub.php
> >
>
>
>
>
>
> --
> PHP Database Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
---
Peter Beckman Internet Guy
[EMAIL PROTECTED] http://www.purplecow.com/
---
--
PHP Database Mailing List (http://www.php.
Re: [PHP-DB] md5 question!
Hi,
Hmmm okay... So if the passowrd was.
jerry
and the md5 output was
SKHDJHDJDHJDHSfdfs
and another user sets their passowrd to the same as
mine does that mean the md5 output would be identical
to the last as the same password is entered?
e.g.
User 1:
Username: Fred
Password: jerry
User 2:
Username: notfred
Password: jerry
Or is each entry unique ?
I'm thinking if each entry was unique than reversing
the md5 action could be inconclusive. But if the
output is the same if the same password is entered
than sure it's reliable. But I could be barking up
the wrong tree all together here, so correct me if I
am wrong. I have not used md5 before so learning on
that behalf.
Jerry
--- [EMAIL PROTECTED] wrote: > Just use brute
force...
> Example:
> md5('password') will ALWAYS produce the same output!
> So, if I intercept a pmd5 encrypted password that
> looks like: SKHGDOIUYFB
> then I could just say:
> if (strcmp (md5('password'), SKHGDOIUYFB) == 0)
> printf("Your password is: %s\n", password);
>
> So, just start a loop going through all possible
> combinations od legal password
> character and encrypt with md5, then compare.
>
> Hard? Not at all, Time consuming, perhaps, but with
> 3+ Ghz processors coming
> out you'd be surprised how quickly one could loop
> through billlions of possible
> password combinations. Enter distributed
> environments and it is much fatser.
> The key is not to rely on passwords but to rely on
> other system security
> messures, use SSL, so it is hard to intercept in the
> first place, make sure
> your system is secure so these passwords cannot be
> extracted from your DB
> without you knowing about it, etc...
>
>
>
> > Marco,
> >
> > Thanks, that's what I originally thought that it
> was
> > one way. So websites that have the option to
> retrieve
> > password don't use md5?
> >
> > I guess technically there MUST be a way to break
> the
> > barrier where you can reverse it. If there is a
> way
> > to make it there is always a way to break it,
> somehow.
> > But what I have heard and read it's very
> tight
> > and probably the best method to handle passwords
> for
> > now, until something new is released. Which will
> > happen when md5 is broken, like everything else
> after
> > a little bit of time.
> >
> > Jerry
> >
> > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi
> > Jerry--
> > >
> > > No, md5 is a one-way hash. That's why it's so
> > > safe--because if someone
> > > steals the information he still can't tell what
> the
> > > passwords are.
> > >
> > > You may want to reset the passwords upon your
> users'
> > > request and send it
> > > to them via e-mail instead.
> > >
> > > Cheers,
> > >
> > >
> > > Marco
> > >
> > > --
> > > php|architect -- The Magazine for PHP
> Professionals
> > > Come try us out at http://www.phparch.com and
> get a
> > > free trial issue
> > >
> > >
> > > On Tue, 2003-06-24 at 08:35, JeRRy wrote:
> > > > Hi,
> > > >
> > > > If I use md5 to handle passwords to my
> database is
> > > > there a way to reverse the action if someone
> > > forgets
> > > > their password? Is there a way for me to
> decode
> > > the
> > > > 32bit to plain text?
> > > >
> > > > Jerry
> > > >
> > > > http://mobile.yahoo.com.au - Yahoo! Mobile
> > > > - Check & compose your email via SMS on your
> > > Telstra or Vodafone mobile.
> > > --
> > >
> > > Marco Tabini
> > > President
> > >
> > > Marco Tabini & Associates, Inc.
> > > 28 Bombay Avenue
> > > Toronto, ON M3H 1B7
> > > Canada
> > >
> > > Phone: (416) 630-6202
> > > Fax: (416) 630-5057
> > > Web: http://www.tabini.ca
> > >
> > >
> > > --
> > > PHP Database Mailing List (http://www.php.net/)
> > > To unsubscribe, visit:
> http://www.php.net/unsub.php
> > >
> >
> > http://mobile.yahoo.com.au - Yahoo! Mobile
> > - Check & compose your email via SMS on your
> Telstra or Vodafone mobile.
> >
> > --
> > PHP Database Mailing List (http://www.php.net/)
> > To unsubscribe, visit:
> http://www.php.net/unsub.php
> >
>
>
>
>
http://mobile.yahoo.com.au - Yahoo! Mobile
- Check & compose your email via SMS on your Telstra or Vodafone mobile.
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] md5 question!
This is waaay over my head, but if any of you are interested: http://www.faqs.org/rfcs/rfc1321 I just read it and have come to the conclusion that MD5 is a small, British sports car ;^) Rich > -Original Message- > From: Marco Tabini [mailto:[EMAIL PROTECTED] > Sent: Tuesday, June 24, 2003 9:30 AM > To: JeRRy > Cc: [EMAIL PROTECTED] > Subject: Re: [PHP-DB] md5 question! > > > On Tue, 2003-06-24 at 09:08, JeRRy wrote: > > I guess technically there MUST be a way to break the > > barrier where you can reverse it. If there is a way > > to make it there is always a way to break it, somehow. > > But what I have heard and read it's very tight > > and probably the best method to handle passwords for > > now, until something new is released. Which will > > happen when md5 is broken, like everything else after > > a little bit of time. > > Well, that's not necessarily true. Take something as simple as an > integer division. Say that in order calculate your hash you divide any > number by 3 and discard the remainder. The result '4' could mean that > your original number could be anywhere between 12 and 14, for example, > so that even if you know that method that was used to > calculate the hash > you couldn't determine the original password from it. md5 works on a > similar basis, although a bit (but not that much) more complicated. So > you see, it's mathematically impossible to retrieve the original > password starting from the hash... which is a Good Thing(tm) :-) > > > Marco > > -- > php|architect -- The Magazine for PHP Professionals > Come try us out at http://www.phparch.com and get a free trial issue > > > > > > > Jerry > > > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi > > Jerry-- > > > > > > No, md5 is a one-way hash. That's why it's so > > > safe--because if someone > > > steals the information he still can't tell what the > > > passwords are. > > > > > > You may want to reset the passwords upon your users' > > > request and send it > > > to them via e-mail instead. > > > > > > Cheers, > > > > > > > > > Marco > > > > > > -- > > > php|architect -- The Magazine for PHP Professionals > > > Come try us out at http://www.phparch.com and get a > > > free trial issue > > > > > > > > > On Tue, 2003-06-24 at 08:35, JeRRy wrote: > > > > Hi, > > > > > > > > If I use md5 to handle passwords to my database is > > > > there a way to reverse the action if someone > > > forgets > > > > their password? Is there a way for me to decode > > > the > > > > 32bit to plain text? > > > > > > > > Jerry > > > > > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > > > > - Check & compose your email via SMS on your > > > Telstra or Vodafone mobile. > > > -- > > > > > > Marco Tabini > > > President > > > > > > Marco Tabini & Associates, Inc. > > > 28 Bombay Avenue > > > Toronto, ON M3H 1B7 > > > Canada > > > > > > Phone: (416) 630-6202 > > > Fax: (416) 630-5057 > > > Web: http://www.tabini.ca > > > > > > > > > -- > > > PHP Database Mailing List (http://www.php.net/) > > > To unsubscribe, visit: http://www.php.net/unsub.php > > > > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > > - Check & compose your email via SMS on your Telstra or > Vodafone mobile. > -- > > Marco Tabini > President > > Marco Tabini & Associates, Inc. > 28 Bombay Avenue > Toronto, ON M3H 1B7 > Canada > > Phone: (416) 630-6202 > Fax: (416) 630-5057 > Web: http://www.tabini.ca > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
On Tue, 2003-06-24 at 09:08, JeRRy wrote: > I guess technically there MUST be a way to break the > barrier where you can reverse it. If there is a way > to make it there is always a way to break it, somehow. > But what I have heard and read it's very tight > and probably the best method to handle passwords for > now, until something new is released. Which will > happen when md5 is broken, like everything else after > a little bit of time. Well, that's not necessarily true. Take something as simple as an integer division. Say that in order calculate your hash you divide any number by 3 and discard the remainder. The result '4' could mean that your original number could be anywhere between 12 and 14, for example, so that even if you know that method that was used to calculate the hash you couldn't determine the original password from it. md5 works on a similar basis, although a bit (but not that much) more complicated. So you see, it's mathematically impossible to retrieve the original password starting from the hash... which is a Good Thing(tm) :-) Marco -- php|architect -- The Magazine for PHP Professionals Come try us out at http://www.phparch.com and get a free trial issue > > > Jerry > > --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi > Jerry-- > > > > No, md5 is a one-way hash. That's why it's so > > safe--because if someone > > steals the information he still can't tell what the > > passwords are. > > > > You may want to reset the passwords upon your users' > > request and send it > > to them via e-mail instead. > > > > Cheers, > > > > > > Marco > > > > -- > > php|architect -- The Magazine for PHP Professionals > > Come try us out at http://www.phparch.com and get a > > free trial issue > > > > > > On Tue, 2003-06-24 at 08:35, JeRRy wrote: > > > Hi, > > > > > > If I use md5 to handle passwords to my database is > > > there a way to reverse the action if someone > > forgets > > > their password? Is there a way for me to decode > > the > > > 32bit to plain text? > > > > > > Jerry > > > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > > > - Check & compose your email via SMS on your > > Telstra or Vodafone mobile. > > -- > > > > Marco Tabini > > President > > > > Marco Tabini & Associates, Inc. > > 28 Bombay Avenue > > Toronto, ON M3H 1B7 > > Canada > > > > Phone: (416) 630-6202 > > Fax: (416) 630-5057 > > Web: http://www.tabini.ca > > > > > > -- > > PHP Database Mailing List (http://www.php.net/) > > To unsubscribe, visit: http://www.php.net/unsub.php > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > - Check & compose your email via SMS on your Telstra or Vodafone mobile. -- Marco Tabini President Marco Tabini & Associates, Inc. 28 Bombay Avenue Toronto, ON M3H 1B7 Canada Phone: (416) 630-6202 Fax: (416) 630-5057 Web: http://www.tabini.ca -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
Speaking of MD5 hashes, I had the idea and the wherewithal to build a site that had a huge pile of passwords and their various matching MD5 hashes, crypts using all 26^2 salts, etc. People could submit passwords (or request that passwords be removed); I'd initially populate it with passwords built from rules used in applications like "john." It would allow sysadmins SOAP access to see if a password was "insecure" quickly and easily. However, the down side to this is that script-kiddies could use the database to break passwords if they can get their grubby little hands on it. I know this is PHP/MySQL list, but I'd write it in PHP/MySQL so it is sort of related. I'd like to hear your thoughts on the pros and cons of such a database. Beckman On Tue, 24 Jun 2003, [iso-8859-1] JeRRy wrote: > Marco, > > Thanks, that's what I originally thought that it was > one way. So websites that have the option to retrieve > password don't use md5? > > I guess technically there MUST be a way to break the > barrier where you can reverse it. If there is a way > to make it there is always a way to break it, somehow. > But what I have heard and read it's very tight > and probably the best method to handle passwords for > now, until something new is released. Which will > happen when md5 is broken, like everything else after > a little bit of time. --- Peter Beckman Internet Guy [EMAIL PROTECTED] http://www.purplecow.com/ --- -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
Just use brute force...
Example:
md5('password') will ALWAYS produce the same output!
So, if I intercept a pmd5 encrypted password that looks like: SKHGDOIUYFB
then I could just say:
if (strcmp (md5('password'), SKHGDOIUYFB) == 0)
printf("Your password is: %s\n", password);
So, just start a loop going through all possible combinations od legal password
character and encrypt with md5, then compare.
Hard? Not at all, Time consuming, perhaps, but with 3+ Ghz processors coming
out you'd be surprised how quickly one could loop through billlions of possible
password combinations. Enter distributed environments and it is much fatser.
The key is not to rely on passwords but to rely on other system security
messures, use SSL, so it is hard to intercept in the first place, make sure
your system is secure so these passwords cannot be extracted from your DB
without you knowing about it, etc...
> Marco,
>
> Thanks, that's what I originally thought that it was
> one way. So websites that have the option to retrieve
> password don't use md5?
>
> I guess technically there MUST be a way to break the
> barrier where you can reverse it. If there is a way
> to make it there is always a way to break it, somehow.
> But what I have heard and read it's very tight
> and probably the best method to handle passwords for
> now, until something new is released. Which will
> happen when md5 is broken, like everything else after
> a little bit of time.
>
> Jerry
>
> --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi
> Jerry--
> >
> > No, md5 is a one-way hash. That's why it's so
> > safe--because if someone
> > steals the information he still can't tell what the
> > passwords are.
> >
> > You may want to reset the passwords upon your users'
> > request and send it
> > to them via e-mail instead.
> >
> > Cheers,
> >
> >
> > Marco
> >
> > --
> > php|architect -- The Magazine for PHP Professionals
> > Come try us out at http://www.phparch.com and get a
> > free trial issue
> >
> >
> > On Tue, 2003-06-24 at 08:35, JeRRy wrote:
> > > Hi,
> > >
> > > If I use md5 to handle passwords to my database is
> > > there a way to reverse the action if someone
> > forgets
> > > their password? Is there a way for me to decode
> > the
> > > 32bit to plain text?
> > >
> > > Jerry
> > >
> > > http://mobile.yahoo.com.au - Yahoo! Mobile
> > > - Check & compose your email via SMS on your
> > Telstra or Vodafone mobile.
> > --
> >
> > Marco Tabini
> > President
> >
> > Marco Tabini & Associates, Inc.
> > 28 Bombay Avenue
> > Toronto, ON M3H 1B7
> > Canada
> >
> > Phone: (416) 630-6202
> > Fax: (416) 630-5057
> > Web: http://www.tabini.ca
> >
> >
> > --
> > PHP Database Mailing List (http://www.php.net/)
> > To unsubscribe, visit: http://www.php.net/unsub.php
> >
>
> http://mobile.yahoo.com.au - Yahoo! Mobile
> - Check & compose your email via SMS on your Telstra or Vodafone mobile.
>
> --
> PHP Database Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
Marco, Thanks, that's what I originally thought that it was one way. So websites that have the option to retrieve password don't use md5? I guess technically there MUST be a way to break the barrier where you can reverse it. If there is a way to make it there is always a way to break it, somehow. But what I have heard and read it's very tight and probably the best method to handle passwords for now, until something new is released. Which will happen when md5 is broken, like everything else after a little bit of time. Jerry --- Marco Tabini <[EMAIL PROTECTED]> wrote: > Hi Jerry-- > > No, md5 is a one-way hash. That's why it's so > safe--because if someone > steals the information he still can't tell what the > passwords are. > > You may want to reset the passwords upon your users' > request and send it > to them via e-mail instead. > > Cheers, > > > Marco > > -- > php|architect -- The Magazine for PHP Professionals > Come try us out at http://www.phparch.com and get a > free trial issue > > > On Tue, 2003-06-24 at 08:35, JeRRy wrote: > > Hi, > > > > If I use md5 to handle passwords to my database is > > there a way to reverse the action if someone > forgets > > their password? Is there a way for me to decode > the > > 32bit to plain text? > > > > Jerry > > > > http://mobile.yahoo.com.au - Yahoo! Mobile > > - Check & compose your email via SMS on your > Telstra or Vodafone mobile. > -- > > Marco Tabini > President > > Marco Tabini & Associates, Inc. > 28 Bombay Avenue > Toronto, ON M3H 1B7 > Canada > > Phone: (416) 630-6202 > Fax: (416) 630-5057 > Web: http://www.tabini.ca > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > http://mobile.yahoo.com.au - Yahoo! Mobile - Check & compose your email via SMS on your Telstra or Vodafone mobile. -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] md5 question!
no. we added to old 'password' question to one of the sites I did for this reason. When the client registered, they picked a question, ssn, mother's maiden name, dog's name, etc and entered an answer. That way if they lost their password, they could go to a 'lost password' area, enter their username, select and answer their question. they were then logged in and could change their password. of course Marco's suggestions is good also, that way you can confirm you are speaking to the actual user before you change their password. Eddie -Original Message- From: JeRRy [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 24, 2003 8:35 AM To: [EMAIL PROTECTED] Subject: [PHP-DB] md5 question! Hi, If I use md5 to handle passwords to my database is there a way to reverse the action if someone forgets their password? Is there a way for me to decode the 32bit to plain text? Jerry http://mobile.yahoo.com.au - Yahoo! Mobile - Check & compose your email via SMS on your Telstra or Vodafone mobile. -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] md5 question!
Hi Jerry-- No, md5 is a one-way hash. That's why it's so safe--because if someone steals the information he still can't tell what the passwords are. You may want to reset the passwords upon your users' request and send it to them via e-mail instead. Cheers, Marco -- php|architect -- The Magazine for PHP Professionals Come try us out at http://www.phparch.com and get a free trial issue On Tue, 2003-06-24 at 08:35, JeRRy wrote: > Hi, > > If I use md5 to handle passwords to my database is > there a way to reverse the action if someone forgets > their password? Is there a way for me to decode the > 32bit to plain text? > > Jerry > > http://mobile.yahoo.com.au - Yahoo! Mobile > - Check & compose your email via SMS on your Telstra or Vodafone mobile. -- Marco Tabini President Marco Tabini & Associates, Inc. 28 Bombay Avenue Toronto, ON M3H 1B7 Canada Phone: (416) 630-6202 Fax: (416) 630-5057 Web: http://www.tabini.ca -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
[PHP-DB] md5 question!
Hi, If I use md5 to handle passwords to my database is there a way to reverse the action if someone forgets their password? Is there a way for me to decode the 32bit to plain text? Jerry http://mobile.yahoo.com.au - Yahoo! Mobile - Check & compose your email via SMS on your Telstra or Vodafone mobile. -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
