[Solved] Does showing hashes compromise security? php

Question

I would agree with the others who have asked why you need to do this, however moving past that to your question, yes it is a bad idea.

For starters, from the password you supplied, I can tell you’re using some form of bcrypt. Admittedly bcrypt is a very strong hashing algorithm that isn’t easily cracked using GPUs and tools like hashcat, however you are still disclosing implementation details by sending this to the user.

Additionally, if your so worried about the user knowing the one time password you generated that tells me it isn’t random. If it isn’t random then even a really strong algorithm like bcrypt won’t save you if someone figures out your the one time password convention.

Finally, I’m not entirely sure how your proposed solution would even work because if you send the user the hash they will enter the hash as their password. The standard login process would then hash what they enter (which in this case is the hash of the one time password you generated) and compare it against what’s stored in the database. It’s overly complicated.

I would suggest just generating a random one time password that’s 10-12 characters long and sending that to the user through a previously verified channel, ie a verified email address or cell phone number.

Accepted Answer

I would agree with the others who have asked why you need to do this, however moving past that to your question, yes it is a bad idea.

For starters, from the password you supplied, I can tell you’re using some form of bcrypt. Admittedly bcrypt is a very strong hashing algorithm that isn’t easily cracked using GPUs and tools like hashcat, however you are still disclosing implementation details by sending this to the user.

Additionally, if your so worried about the user knowing the one time password you generated that tells me it isn’t random. If it isn’t random then even a really strong algorithm like bcrypt won’t save you if someone figures out your the one time password convention.

Finally, I’m not entirely sure how your proposed solution would even work because if you send the user the hash they will enter the hash as their password. The standard login process would then hash what they enter (which in this case is the hash of the one time password you generated) and compare it against what’s stored in the database. It’s overly complicated.

I would suggest just generating a random one time password that’s 10-12 characters long and sending that to the user through a previously verified channel, ie a verified email address or cell phone number.