{"id":9243,"date":"2022-09-18T00:00:23","date_gmt":"2022-09-17T18:30:23","guid":{"rendered":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/"},"modified":"2022-09-18T00:00:23","modified_gmt":"2022-09-17T18:30:23","slug":"solved-does-showing-hashes-compromise-security-php","status":"publish","type":"post","link":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/","title":{"rendered":"[Solved] Does showing hashes compromise security? php"},"content":{"rendered":"

[ad_1]
\n<\/p>\n

\n
\n
<\/div>\n
\n
\n

I would agree with the others who have asked why you need to do this, however moving past that to your question, yes it is a bad idea.<\/p>\n

For starters, from the password you supplied, I can tell you’re using some form of bcrypt. Admittedly bcrypt is a very strong hashing algorithm that isn’t easily cracked using GPUs and tools like hashcat, however you are still disclosing implementation details by sending this to the user.<\/p>\n

Additionally, if your so worried about the user knowing the one time password you generated that tells me it isn’t random. If it isn’t random then even a really strong algorithm like bcrypt won’t save you if someone figures out your the one time password convention.<\/p>\n

Finally, I’m not entirely sure how your proposed solution would even work because if you send the user the hash they will enter the hash as their password. The standard login process would then hash what they enter (which in this case is the hash of the one time password you generated) and compare it against what’s stored in the database. It’s overly complicated.<\/p>\n

I would suggest just generating a random one time password that’s 10-12 characters long and sending that to the user through a previously verified channel, ie a verified email address or cell phone number.<\/p>\n<\/p><\/div>\n

<\/div>\n<\/div>\n

<\/span> <\/p><\/div>\n<\/div>\n

[ad_2]<\/p>\n

solved Does showing hashes compromise security? php <\/p>\n","protected":false},"excerpt":{"rendered":"

[ad_1] I would agree with the others who have asked why you need to do this, however moving past that to your question, yes it is a bad idea. For starters, from the password you supplied, I can tell you’re using some form of bcrypt. Admittedly bcrypt is a very strong hashing algorithm that isn’t … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[320],"tags":[1171,339,342],"class_list":["post-9243","post","type-post","status-publish","format-standard","hentry","category-solved","tag-hash","tag-php","tag-security"],"yoast_head":"\n[Solved] Does showing hashes compromise security? php - JassWeb<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"[Solved] Does showing hashes compromise security? php - JassWeb\" \/>\n<meta property=\"og:description\" content=\"[ad_1] I would agree with the others who have asked why you need to do this, however moving past that to your question, yes it is a bad idea. For starters, from the password you supplied, I can tell you’re using some form of bcrypt. Admittedly bcrypt is a very strong hashing algorithm that isn’t ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/\" \/>\n<meta property=\"og:site_name\" content=\"JassWeb\" \/>\n<meta property=\"article:published_time\" content=\"2022-09-17T18:30:23+00:00\" \/>\n<meta name=\"author\" content=\"Kirat\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kirat\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/\"},\"author\":{\"name\":\"Kirat\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31\"},\"headline\":\"[Solved] Does showing hashes compromise security? php\",\"datePublished\":\"2022-09-17T18:30:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/\"},\"wordCount\":244,\"publisher\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\"},\"keywords\":[\"hash\",\"php\",\"security\"],\"articleSection\":[\"Solved\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/\",\"url\":\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/\",\"name\":\"[Solved] Does showing hashes compromise security? php - JassWeb\",\"isPartOf\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#website\"},\"datePublished\":\"2022-09-17T18:30:23+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jassweb.com\/solved\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"[Solved] Does showing hashes compromise security? php\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jassweb.com\/solved\/#website\",\"url\":\"https:\/\/jassweb.com\/solved\/\",\"name\":\"JassWeb\",\"description\":\"Build High-quality Websites\",\"publisher\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jassweb.com\/solved\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\",\"name\":\"Jass Web\",\"url\":\"https:\/\/jassweb.com\/solved\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png\",\"contentUrl\":\"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png\",\"width\":693,\"height\":132,\"caption\":\"Jass Web\"},\"image\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31\",\"name\":\"Kirat\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750\",\"contentUrl\":\"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750\",\"caption\":\"Kirat\"},\"sameAs\":[\"http:\/\/jassweb.com\"],\"url\":\"https:\/\/jassweb.com\/solved\/author\/jaspritsinghghumangmail-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"[Solved] Does showing hashes compromise security? php - JassWeb","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/","og_locale":"en_US","og_type":"article","og_title":"[Solved] Does showing hashes compromise security? php - JassWeb","og_description":"[ad_1] I would agree with the others who have asked why you need to do this, however moving past that to your question, yes it is a bad idea. For starters, from the password you supplied, I can tell you’re using some form of bcrypt. Admittedly bcrypt is a very strong hashing algorithm that isn’t ... Read more","og_url":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/","og_site_name":"JassWeb","article_published_time":"2022-09-17T18:30:23+00:00","author":"Kirat","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kirat","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/#article","isPartOf":{"@id":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/"},"author":{"name":"Kirat","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31"},"headline":"[Solved] Does showing hashes compromise security? php","datePublished":"2022-09-17T18:30:23+00:00","mainEntityOfPage":{"@id":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/"},"wordCount":244,"publisher":{"@id":"https:\/\/jassweb.com\/solved\/#organization"},"keywords":["hash","php","security"],"articleSection":["Solved"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/","url":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/","name":"[Solved] Does showing hashes compromise security? php - JassWeb","isPartOf":{"@id":"https:\/\/jassweb.com\/solved\/#website"},"datePublished":"2022-09-17T18:30:23+00:00","breadcrumb":{"@id":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jassweb.com\/solved\/solved-does-showing-hashes-compromise-security-php\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jassweb.com\/solved\/"},{"@type":"ListItem","position":2,"name":"[Solved] Does showing hashes compromise security? php"}]},{"@type":"WebSite","@id":"https:\/\/jassweb.com\/solved\/#website","url":"https:\/\/jassweb.com\/solved\/","name":"JassWeb","description":"Build High-quality Websites","publisher":{"@id":"https:\/\/jassweb.com\/solved\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jassweb.com\/solved\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jassweb.com\/solved\/#organization","name":"Jass Web","url":"https:\/\/jassweb.com\/solved\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/","url":"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png","contentUrl":"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png","width":693,"height":132,"caption":"Jass Web"},"image":{"@id":"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31","name":"Kirat","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/image\/","url":"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750","contentUrl":"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750","caption":"Kirat"},"sameAs":["http:\/\/jassweb.com"],"url":"https:\/\/jassweb.com\/solved\/author\/jaspritsinghghumangmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts\/9243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/comments?post=9243"}],"version-history":[{"count":0,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts\/9243\/revisions"}],"wp:attachment":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/media?parent=9243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/categories?post=9243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/tags?post=9243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}