|
Password encryption is a must.
The strength depends on the type of encryption and its classification. Passwords for web apps are often stored as hashed passwords which means that they cannot be reversed to retrieve the original password. MD5 is a common hashing algorithm used for this purpose, and I believe its collision probability is 2^128 - 1 (if someone with more cryptography knowledge could confirm this). I can't even calculate that number, though I recall hearing that a method has been created that compromises this hash - I'll see if I can track down the link, but it was awhile ago.
I generally do md5 with an added salt. So, in my database I have a record for a user containing their password which was calculated from md5(md5($password) . $salt), and when I store cookies I just use the md5($password) and later retrieve the salt, recalculate and compare. The added salt is nice since if you're db is ever compromised then even the same passwords used appear different in their hash.
For autologins the only real option is to use a cookie. And if they forget to uncheck the shared computer option then the next person that uses it will automatically be logged in (if its the same user account). The only alternative is to also store an ip address in the database and use that. This is not reliable as IPv4 is often reassigned on dynamic hosts, so this method would work for something like a business environment, but not a public environment since its not overly secure. If you could get the mac address its would be much more secure, but this is almost impossible in PHP; I've managed to retrieve the mac using an IIS server and exec with... ntds I think it was, but haven't figured out a solution using Linux yet. BTW, this has extreme, and I mean extreme overhead to perform the calculations for it.
I hope that helps point you in the right direction - I know that I tend to ramble, so hopefully it doesn't confuse you :P
|
