Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Message-ID: <4DF51885.50604@apache.org>
Date: Sun, 12 Jun 2011 20:50:29 +0100
From: Mark Thomas <markt@apache.org>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB;
 rv:1.9.2.17) Gecko/20110414 Thunderbird/3.1.10
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: user tomcat authentication
References: <BANLkTikDecGy4O=jtJKOBQTVtQ4GhgjfrA@mail.gmail.com>
 <4DF228CF.8050603@pidster.com> <4DF4E559.8090300@gmail.com>
 <4DF5138C.9000608@pidster.com>
In-Reply-To: <4DF5138C.9000608@pidster.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 12/06/2011 20:29, Pid wrote:
> On 12/06/2011 17:12, Petr Hracek wrote:
>> And what about in case that I have my own program for accessing to the
>> specific
>> databases where the passwords are stored as hashes?
>>
>> Are there any possibilities how to run that program for getting unhashed
>> password from database?
> 
> Why not hash the inbound password, then send & compare it against the
> one in the DB, rather than decoding it?
> 
> The Realm implementations can handle this, if you're using a standard
> hashing method that Java recognises.
> 
> Hopefully you've not invented your own hashing method.

Hmm. Hash functions are meant to be one way. It should be impossible to
retrieve an unhashed password from the database.

I hope that the original description is inaccurate rather than an
example of (yet another) badly broken home-grown security solution that
needs to be thrown away.

Mark

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org