Password validation using ion auth in CodeIgniter

Question

I am almost done with a project using codeigniter and ion_auth for authentication. I can't figure out this little issue:

When the user wants to change the password, I have the fields OLD_PASSWORD and NEW_PASSWORD. OLD_PASSWORD has to match the database's password (DB_PASSWORD). But I can't figure out how the password was encrypted to be stored in the database. So OLD_PASSWORD never matches DB_PASSWORD, obviously.

I haven't changed any of the default encryption for ION_AUTH library. I tried sha1() function and it didn't match the encryption. Same for md5(), which is not recommended for encrypting passwords anymore.

Can anyone shine a light on this for me?

As a note, you should never be able to actually be able to read the user's password from the database - if you can, your system is not secure. — Krease
Ok. So how do you go about verifying password? How do you keep it secured? I've read a few articles about security but there are so many controversies between writers that it becomes hard to know how to keep your site safe. — Caio Mars
This and the password management tag on Information Security Stackexchange site are some recommended reading if you're learning about this. It's a bit of a tangent from your original question, but useful to know if you're working in this area. — Krease
Sweet! I took a quick look and will definitely read it later. Thanks! — Caio Mars
@Jonast92 thanks for the comment! I will do my homework on site security. What you said makes very much sense. Appreciate it. — Caio Mars

Ben Edmunds Ben Edmunds · Accepted Answer · 2014-02-12T21:15:27

Ion auth creator here.

The default encryption is sadly using SHA1 for backwards compatibility.

There is an option in the config to use BCrypt instead which is strongly recommended.

The password is hashed along with a salt though so simply running SHA1 against the password won't give you the same results. Take a look at the hash_password() method to see how it's done here: https://github.com/benedmunds/CodeIgniter-Ion-Auth/blob/2/models/ion_auth_model.php#L267

If you're using all the defaults you can do this to compare:

$user = $this->ion_auth->user();

$old_password = $this->input->post('old_password');

$password_matches = $this->ion_auth->hash_password_db($user->id, $old_password);

Password validation using ion auth in CodeIgniter

1 Answers