PHP解除密码 [英] PHP dehashing the password

问题描述

好的。清除了必须在数据库中存储散列密码，但是如果用户不记住密码并且想要将其恢复，则显然用户不喜欢具有散列密码。如果密码使用md5或其他类似salt和sha1进行哈希处理，那么如何检索回密码。

Ok. thats clear that one must store hashed password in the database but in case a user does not remembers the password and want to retrieve it back, then obviously the user wont like to have the hashed password. If the password is hashed with md5 or additional like salt and sha1 then how to retrieve back the password.

推荐答案

只是一个简单的答案：你不能。

好吧，理论上你可以，但如果它们足够长，可能需要多年密码。毕竟，这是哈希密码的第一位：使数据对攻击者无效（或至少保护用户的明文密码，这是敏感数据）。

Well, theoretically you could, but it could take many years per password if they are long enough. After all, that is the point of hashing passwords in the first place: to make the data effectively useless to an attacker (or at least protect the user's plaintext password, which is sensitive data.)

只要网站发送更改您的密码电子邮件，其中包含指向该用户可以更改其密码的页面的链接。这是大多数专业网站如何处理这个困境。

Just have the site send a "change your password" email containing a link to a page where that user can change his/her password. This is how most professional sites handle this dilemma.

这篇关于PHP解除密码的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！