On 8/10/06, Christopher H. Laco <[EMAIL PROTECTED]> wrote:
Also, you could use something like:
http://pajhome.org.uk/crypt/md5/sha1src.html
And do your hashing in _javascript_ in the browser. Basically you want to hook onClick/onSubmit/whatever for your login form, and hash the contents of the passwd field before doing the actual submission, using a _javascript_ sha1 (or other algorithm of your choosing).
Its much safer from a security standpoint to hash at the browser, as this prevents the user's cleartext password from being sent over the wire at all, and keeps your code/logs/employees from ever having a chance at knowledge of the actual password.
-- Brandon
Jonas wrote:
> Hi,
> I'm trying to store an hashed password in a database using DBIC. What
> is the best way to create the digest of the password?
> I tried with deflate, but deflate only runs when the argument is a reference.
> Then i tried with an HTML::Widget Filter but the filter runs before
> the constraints, so the password failed to match with the confirm
> field.
> There are any other way of doing this without explicitly making the
> hash in the insert and update methods?
>
> Thanks,
> --Jonas
http://search.cpan.org/dist/DBIx-Class-DigestColumns/
Also, you could use something like:
http://pajhome.org.uk/crypt/md5/sha1src.html
And do your hashing in _javascript_ in the browser. Basically you want to hook onClick/onSubmit/whatever for your login form, and hash the contents of the passwd field before doing the actual submission, using a _javascript_ sha1 (or other algorithm of your choosing).
Its much safer from a security standpoint to hash at the browser, as this prevents the user's cleartext password from being sent over the wire at all, and keeps your code/logs/employees from ever having a chance at knowledge of the actual password.
-- Brandon
_______________________________________________ List: [email protected] Listinfo: http://lists.rawmode.org/mailman/listinfo/catalyst Searchable archive: http://www.mail-archive.com/[email protected]/ Dev site: http://dev.catalyst.perl.org/
