SHA1 Password returns as cleartext after DB query

Posted by Code Sherpa on Stack Overflow See other posts from Stack Overflow or by Code Sherpa
Published on 2010-04-07T03:56:14Z Indexed on 2010/04/07 4:03 UTC
Read the original article Hit count: 211

Filed under:

sha1

|

salt

|

passwords

|

sql

Hi.

I have a SHA1 password and PasswordSalt in my aspnet_Membership table. but, when I run a query from the server (a Sql Query), the reader reveals that the pass has returned as its cleartext equivalent.

I am wondering if my web.config configuration is causing this?

<membership defaultProvider="CustomMembershipProvider" 
                userIsOnlineTimeWindow="20"
                hashAlgorithmType="SHA1">
      <providers>
        <clear/>
        <add  name="CustomMembershipProvider"
              type="Custom.Utility.CustomMembershipProvider"
              connectionStringName="MembershipDB"
              enablePasswordRetrieval="false"
              enablePasswordReset="true"
              requiresUniqueEmail="false"
              requiresQuestionAndAnswer="false"
              passwordStrengthRegularExpression=""
              minRequiredPasswordLength="1"
              minRequiredNonalphanumericCharacters="0"
              passwordFormat="Hashed"

thanks in advance...

© Stack Overflow or respective owner

Related posts about sha1

PBKDF2-HMAC-SHA1

as seen on Stack Overflow - Search for 'Stack Overflow'
To generate a valid pairwise master key for a WPA2 network a router uses the PBKDF2-HMAC-SHA1 algorithm. I understand that the sha1 function is performed 4096 times to derive the PMK, however I have two questions about the process. Excuse the pseudo code. 1) How is the input to the first instance… >>> More
Is it possible to get identical SHA1 hash?

as seen on Stack Overflow - Search for 'Stack Overflow'
Given two different strings S1 and S2 (S1 != S2) is it possible that: SHA1(S1) == SHA1(S2) is True? If yes - with what probability? Is there a upper bound on the length of a string, for which probably of getting duplicates is 0? If not - why not? Thanks >>> More
Is it possible to convert a 40-character SHA1 hash to a 20-character SHA1 hash?

as seen on Stack Overflow - Search for 'Stack Overflow'
My problem is a bit hairy, and I may be asking the wrong questions, so please bear with me... I have a legacy MySQL database which stores the user passwords & salts for a membership system. Both of these values have been hashed using the Ruby framework - roughly like this: hashedsalt = … >>> More
Is there any difference between md5 and sha1 in this situation?

as seen on Stack Overflow - Search for 'Stack Overflow'
It is known that 1. if ( md5(a) == md5(b) ) 2. then ( md5(a.z) == md5(b.z) ) 3. but ( md5(z.a) != md5(z.b) ) where the dots concatenate the strings. What happens in the second row if we change all the md5 to sha1? So: 1. if ( sha1(c) == sha1(d) ) 2. then ( sha1(c.z)… >>> More
iPhone: convert string using HMAC-SHA1

as seen on Stack Overflow - Search for 'Stack Overflow'
hi all, i want to generate HMAC-SHA1 of NSString type variable. I see the post but this method give me error in CCHmac(kCCHmacAlgSHA256, cKey, strlen(cKey), cData, strlen(cData), cHMAC); and NSString *hash = [HMAC base64Encoding]; line. Please suggest how can I generate the HMAC-SHA1 of any string… >>> More

Related posts about salt

Why is a password salt called a "salt"?

as seen on Stack Overflow - Search for 'Stack Overflow'
Is there a significance to the word "salt" for a password salt? >>> More
Salt question - using a "random salt"

as seen on Stack Overflow - Search for 'Stack Overflow'
Hey everyone, Further to my question here, I have another question regarding salts. When someone says "use a random salt" to pre/append to a password, does this mean: Creating a static a 1 time randomly generated string of characters, or Creating a string of characters that changes at random… >>> More
Generating a salt in PHP

as seen on Stack Overflow - Search for 'Stack Overflow'
What's the best way to generate a cryptographically secure 32 bytes salt in PHP, without depending on libraries seldom included in typical PHP installations? After some googling I discovered that mt_rand is not considered secure enough, but I haven't found a suggestion for a replacement. One article… >>> More
Salt, passwords and security

as seen on Stack Overflow - Search for 'Stack Overflow'
I've read through many of the questions on SO about this, but many answers contradict each other or I don't understand. You should always store a password as a hash, never as plain text. But should you store the salt (unique for each user) next to the hashed password+salt in the database. This doesn't… >>> More
salt and rainbow table

as seen on Stack Overflow - Search for 'Stack Overflow'
what is "salt", also what is "rainbow table". >>> More