Yes, that's 47917 times the age of the universe. Or even better: 47917 times the age of the universe Let's try to bring that down to more friendly numbers. Time_to_guess = 3.4e38 / 50,000,000,000,000,000 You Keep Me Hangin On by The Supremes song meaning, lyric interpretation. That's fast! Right? time_to_guess = possibilities / guesses_per_second In reality your servers would melt under such load, but let's play this out.

Now, to show how absurdly large that number is, let's imagine every server on the internet (let's say 50,000,000 today) trying to brute-force that number at a rate of 1,000,000,000 per second each. That means that there are: possibilities = 2^128 What if the attacker guesses the random token of another user? Add that to a database table which maps the token to the userid, and then send it to the client in the cookie. When the user logs in, generate a large (128 to 256 bit) random token. The better way is to never let a user's information leave the server, except for the id. That line of thinking has a name: Security Through Obscurity, which should NEVER be relied upon. In short, the only thing protecting you is the salt, which isn't really protecting you as much as you think.Īll of that was predicated that the attacker knows the algorithm! If it's secret and confusing, then you're safe, right? WRONG. And unless you use sufficient randomness in it (make it large enough), it's going to fall quickly, and with it the keys to your castle. But modern day GPUs are exceedingly good at it. Now, all an attacker needs to do is brute force the 'salt' (which isn't really a salt, but more on that later), and he can now generate all the fake tokens he wants with any username for his IP address! But brute-forcing a salt is hard, right? Absolutely. Let's also imagine for a second that they know the algorithm that you used. When you are not in the circle, then you dont know what is going on. You see a cryptographic cookie set for the remember-me on your session. Explanation: Loop is a cycle or a continual circular motion. Imagine for a second that you're an attacker. What's wrong with hashing user data, you ask? Well, it comes down to exposure surface and security through obscurity. OK, let me put this bluntly: if you're putting user data, or anything derived from user data into a cookie for this purpose, you're doing something wrong.

Whats keeping me