m0nty wrote:
Quote:

Suppose the hacker finds a file include vuln. he'll be able to read the content of mainfile.php, connect to the database and find the md5 passwords no?

couldn't he do that even if it was sha-256 encrypted aswell though?

either way, even if he has your md5 key, it's unlikely he'll be able to find out what password you actually use.. he might be able to find a key sequence that gives the same md5 key.. & if the hacker as got as far as a file include vulnerability then he could literally destroy the db or whatever regardless of what encryption method your site uses. he could also change the keys to some that he has produced anyway, so he could literally change your password to a password key that he knows. after all he has access to the DB itself.

stop the source of the exploitation rather than trying to solve an issue that could have been prevented at the source.

prevention is better than cure.

MadFish wrote:
Quote:

is it possible to encrypt the password using sha-256 instead of md5 in the XOOPS user table? how can i do?
md5 is VERY unsecure and my website has been hacked recently. 350+ students passwords have been stolen...

It's very unlikely that they decrypted anything. Much more likely that they ran a dictionary attack against the hashes, and that a lot of your users had chosen weak passwords. Stronger encryption won't stop this kind of attack. The solution is to force your users to choose longer and more difficult passwords.

You can set a minimum password length in the system module preferences, but at the moment I don't think there's any way to make people use difficult passwords (there was a thread on that a week or two ago though...might be worth a look).