Search code examples
javapasswordsmd5password-hash

is hashing mechanism really secure?


Well, I have always seen (and following) people saying to use hashing mechanism for storing passwords in database. I am really concerned is it secure?

Lets go with example.

Let's say I am hacker and I got your database name, id and password. Now I have FULL access to your database.

What people say passwords should be hashed because if someone hacks, they are visible to hackers.

so If I run query as select id, password FROM userDetails I will get data as below

Option 1 : Without hash

++++++++++++++++++++++++++++
+   id    +    password    +
++++++++++++++++++++++++++++
+  id01    +  password01   +
+  id02    +  password02   +
++++++++++++++++++++++++++++

Option 2 : With Hash

++++++++++++++++++++++++++++
+   id    +    password    +
++++++++++++++++++++++++++++
+  id01    +  hasValue01   +
+  id02    +  hasValue02   +
++++++++++++++++++++++++++++

Well, still I say, hashing is insecure. Why I will tell you below with Java code.

PreparedStatement pst = conn.prepareStatement("SELECT id, password FROM userDetails");
ResultSet rs = pst.executeQuery();
String randomPassword = "";
StringBuffer sb;
boolean myPassCheck = true;
while (rs.next()) {
    myPassCheck = true;
    while (myPassCheck) {
        // this will generate random password
        randomPassword = generateRandomPassword();
        MessageDigest md = MessageDigest.getInstance("MD5");
        byte[] array = md.digest(randomPassword.getBytes());
        sb = new StringBuffer();
        for (int i = 0; i < array.length; ++i) {
            sb.append(Integer.toHexString((array[i] & 0xFF) | 0x100).substring(1, 3));
        }
        if (sb.toString().equals(rs.getString(2))) {
            // this is password
            myPassCheck = false;
            System.out.print("id=" + rs.getString(1) + ", password=" + sb.toString());
        }
    }
}

This way, I can print the username and password. (I know I will have to generate random password till I have not found the password). However in this way, hashing password mechanism also fails.

Also I believe there is decryptor present in this world which will convert the hash data to actual data.

Hence, I am thinking

Is Hashing Mechanism Is Secure?


Edit 1

I am not talking about MD5 only. I choose MD5 for example purpose ONLY. I am talking about any mechanism for secure password


Solution

  • No, just using hash, especially when just applying MD5 to the password, isn't secure because :

    • if you just convert a password (which is frequently almost a common word), it's easy to test it using a database of common passwords. So always use a salt and preferably a combination of other constant parts of the user record. Sometimes you may even find the origin of a hash by typing the hash in Google...
    • MD5 is prone to collisions, so even with a hash, prefer SHA 256 or better
    • MD5 is fast to compute, so fast to test in a brute force attack

    Use the hashing mechanism but :

    • take a better hash function, for example SHA-256 or SHA-512
    • hash a constructed string, for example username+salt+password (you can use a constant salt as long as it's not used by other programs, it's enough for most uses)

    The process when you register somebody (or somebody changes his password) is

    1) to build the string s as s=username+salt+password (or a similar function)

    2) to build the hash as SHA256(s)

    3) to store in database the username, the salt (if not constant) and the hash

    When authenticating a user, you build the hash in the same way (using the username and password given by the user and the salt you have in database) and you compare the username and the hash to what you have in database. You don't reverse the hash function, because that's not feasible.


    Now regarding your code : your approach seems to be to generate all possible passwords until one has the same MD5 than the password you're trying to guess. This won't work for reasonable passwords because there isn't enough time to test all combinations of 15 characters.