Working on a more sucure login system

[Austin]

I've started working on a more secure login system for Zezombia.com, which you can see and try out here: http://www.zezombia.com/logintest/. The problem is:

http://answers.yahoo.com/question/index;_ylt=Ame996T.D.DD36ItvJU6FSzsy6IX;_ylv=3?qid=20090710092335AAz7tJy

I can see a 403 here: http://www.zezombia.com/logintest/passwords/
But not here: http://www.zezombia.com/logintest/passwords/Balls

Any help, iNerdz ?

 

[Andre]

What the hell? Do you actually keep your passwords in a folder or something?!
To block access to a certain part you should htaccess it as this:
"deny from all"
But still, why not use MySQL with md5 encryption and since I'm so leet in PHP I could help ya.

 

[Austin]

I'm not gonna get bothered with MySQL .

But what do you mean "deny from all"? Put that in a .htaccess?

 

[Andre]

If you htaccess the directories then everyone will get a 403 except for when server receives passwords from it. I think

 

[Remis]

I would save the password hashed in ONE file for all users in ONE directory, which contains a .htacces, which blocks everyone.
The best way is to use sqlite for this.
Like zezombia.com/secret234/users.db

Instead of taking md5 I would take an own function, its easy in php (just switch the ascii code with ord(); ). The encryption itself isn't more secure then. But the fact that you wrote the function and the encyption function isn't public, so only you knows how the passwords are hashed, makes it more secure.
THEN you can really call it "more secure".

 

[Andre]

Oh here's a function for you:

function encrypt($wat)
{
    $wat = str_replace("Q", "[QUIT]", $wat);
    $wat = str_replace("W", "[WAIT]", $wat);
    $wat = str_replace("E", "[EST]", $wat);
    $wat = str_replace("R", "[ROFL]", $wat);
    $wat = str_replace("T", "[TMS]", $wat);
    $wat = str_replace("Y", "[YES]", $wat);
    return $leetstring;
}

password "QWERTY" becomes "[QUIT][WAIT][EST][ROFL][TMS][YES]".
Great job No seriously I doubt I got the str_replace usage right cuz I don't use much string functions.

 

[Austin]

Those kind of encryption's are easily crackable. What Remis posted would be great, but I keep getting an error:

<?php
$str = "hello";
$passvar = 0;

for($i = 0; $i < 16; $i++)
{
	$passvar = $passvar + ord(str[$i]); //line 7
}

echo $passvar;
?>

Parse error: syntax error, unexpected '[' in /home/themaves/public_html/zezombia.com/testenc.php on line 7

Obviously php doesn't work like pawn.

 

[Remis]

you forgot a $
ord(str[$i]); -> ord($str[$i]);

 

[Austin]

Oops, lol. Thanks.