2

I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an activation token.

However, the application has a bug currently, where the DB was set up with the password field NOT NULL, and without default value, which makes INSERTs fail.

If I modify my table structure and set a default value for the password (using some arbitrary encrypted value), admins can add new users and these users are prompted to set a password prior to first login.

My question is - is there a security risk here that I should be aware of?

Copied: Is it secure to set default value for password field? - DBA StackExchage

  • 5
    Set the password to some arbitrary value that cannot possibly used for authentication. Assuming the real passwords are hashed, set the default value to some random value whose length will never match the output of the digest. Even "0" would work if it prevents authentication until the user users their invitation code. – vcsjones Jul 14 '15 at 15:42
  • Thanks for the suggestion. Password authentication part is already done and I don't want to touch it. – Foreever Jul 14 '15 at 16:00
2

If your hashing function is secure enough this shouldn't be a problem, even if an attacker know your default value he cannot in a reasonable time find a password hashing in your default value.

Anything that isn't the the result of your hashing function is a good default value (i still think you should use a random value and not your first pet name but both are ok).

| improve this answer | |
  • Ya, I'm using a hash of a random value. really wanted to use NULL as value and handle this in authentication though. – Foreever Jul 16 '15 at 6:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.