Checking if the input-password was correct

My program was only for me until now. I got asked to make it public for my school, but since now i just compare useriname and password like
if inputu == username && inputp == password
but then i head about hooking and stuff to read out the memory and if i compare it like this it should be really easy to get access.
I have no idea about making it save, I heard about "hashing" the pw and then hash the input too with the same algorithm and compare the hashs but cant you read out the algorithm too? I have no idea, thank you for help!
I got asked to make it public for my school


I don't have any context for this, but you don't have to release anything that is yours.

The idea is that you have a database. Instead of storing usernames with their associated passwords in plain-text, you store usernames along with hashed passwords.

Cryptographic hash functions are "one way" functions, meaning that it's easy to generate a hash from something, but it's very difficult to determine the original data just by looking at a hash. The source code for most hash functions are publicly available, and that's not a problem. These hashing functions are designed not to rely on their security through obscurity. Just knowing how the hash function works is not useful to an attacker.

Take a look here:
https://en.wikipedia.org/wiki/Cryptographic_hash_function#/media/File:Cryptographic_Hash_Function.svg

The "digest" in this diagram is the hash. You can see that the input data can be any length, but the resulting hash has a fixed length. Additionally, the smallest change in the input data changes the entire hash (look up "avalanche effect").
Last edited on
Topic archived. No new replies allowed.