Password encryption algorithm - security

Question

I want to develop a web application where users can login inserting their email and password (chosen when register). I want to know which would be the best password hashing algorithm. I have read that bcrypt is a good option, but what algorithm do sites like facebook use?

Answer 1

You'll want to store a hash and a salt in your database and use those for authentication. This article in particular was very helpful for me when I implemented this: http://www.codeproject.com/Articles/704865/Salted-Password-Hashing-Doing-it-Right

Answer 2

You should never store a password, even if it is encrypted. Because something that is encrypted can be descrypted, so an attacker could do the same.
Google for "hashing" and "salting", perhaps OWASP has some recommendations how to do this properly. Storing encrypted passwords will be on the list of vulnerabilities to avoid, I think.

Answer 3

I have written an 2 functions for handling passwords. The first one accepts a string (i.e. your password) and returns a seeded hash. It takes an MD5 hash of the time and prepends it to the string. It then takes a SHA256 hash of that string. It then prepends the original MD5 hash to the SHA256 hash. The function returns this 96-character string. The second function takes 2 strings as this arguments (the password being tested and the password hash you are tested it against) and returns a Boolean value. This is PHP, but the logic is of course transferable.
function hash_password( $password ){
$md5 = strtoupper( hash( 'md5', time() ) );
$hash = $md5 . strtoupper( hash( 'sha256', $md5 . $password ) );
return $hash;
}
function test_password( $password, $hash ){
$md5 = substr( $hash, 0, 32 );
$sha256 = substr( $hash, 32 );
if( $sha256 == strtoupper( hash( 'sha256', $md5 . $password ) ) )
return true;
else
return false;
}