And I'll add hashing passwords is better than encrypting them Ling.
As you probably know Ling, something that is unencrypted can be decrypted if you know the keys. Hashing is very different. I am sure if someone worked out the hashing algorithms you could try to reverse them but even then it might not be possible.
I learnt a lesson when coding stuff for work. I encrypted a password for use by a 'service' I wrote to make our lives easier. I spent a lot of time on creating a random key, all sorts... then I found out the SQL password for sa was blank! So my code encrypted it and result was a blank password still.
So the solution was to pad passwords to maximum and then encrypt (I needed the decrypt part).
So no passwords are not stored clear text and are not even stored encrypted. Sorry for the techno speak.
Last edited by: welshy on Wed 24 Feb 10 at 18:39
|