# AWDwR Login Question

**URL:** <https://www.ruby-forum.com/t/awdwr-login-question/72176>\
**Category:** Rails\
**Created:** [October 15, 2006, 3:41am UTC](https://www.ruby-forum.com/t/awdwr-login-question/72176 "2006-10-15T03:41:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [October 15, 2006, 3:41am UTC](https://www.ruby-forum.com/t/awdwr-login-question/72176/1 "2006-10-15T03:41:19Z")

</div>

In the following code there is a comparison of the password stored in  
the database with the  
password entered by the user. Since the salt is created by appending a  
random number, how come it  
matches with what is stored in the database?

def self.authenticate(name, password)  
user = self.find\_by\_name(name)  
if user  
expected\_password = encrypted\_password(password, user.salt)  
if user.hashed\_password != expected\_password  
user = nil  
end  
end  
user

create\_new\_salt  
self.hashed\_password = User.encrypted\_password(self.password, self.salt)  
end  
private  
def self.encrypted\_password(password, salt)  
string\_to\_hash = password + “wibble” + salt # ‘wibble’ makes it harder  
to guess  
Digest::SHA1.hexdigest(string\_to\_hash)  
end  
def create\_new\_salt  
self.salt = self.object\_id.to\_s + rand.to\_s  
end  
end

TIA.

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [October 15, 2006, 4:08pm UTC](https://www.ruby-forum.com/t/awdwr-login-question/72176/2 "2006-10-15T16:08:27Z")

</div>

On Sat, 14 Oct 2006 18:39:16 -0700 (PDT), Bala P. wrote:

> In the following code there is a comparison of the password stored in the database with the  
> password entered by the user. Since the salt is created by appending a random number, how come it  
> matches with what is stored in the database?

The salt’s created only the first time it’s needed; after that, it’s  
always  
the same (note that it’s stored in the user’s record). So it’s “random”  
to  
anyone trying a dictionary attack, but perfectly deterministic to your  
application.

Jay L.

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [October 15, 2006, 5:50pm UTC](https://www.ruby-forum.com/t/awdwr-login-question/72176/3 "2006-10-15T17:50:36Z")

</div>

On Oct 14, 2006, at 8:39 PM, Bala P. wrote:

> In the following code there is a comparison of the password stored  
> in the database with the  
> password entered by the user. Since the salt is created by  
> appending a random number, how come it  
> matches with what is stored in the database?

The salt is stored in the user record when it is created.

Cheers

Dave

---

<div class="post-metadata">

**Author:** ![bparanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e9a140/32.png) [@bparanj](https://www.ruby-forum.com/u/bparanj)\
**Post date:** [October 15, 2006, 5:59pm UTC](https://www.ruby-forum.com/t/awdwr-login-question/72176/4 "2006-10-15T17:59:11Z")

</div>

Bala P. wrote:

> In the following code there is a comparison of the password stored in  
> the database with the  
> password entered by the user. Since the salt is created by appending a  
> random number, how come it  
> matches with what is stored in the database?
> 
> def self.authenticate(name, password)  
> user = self.find\_by\_name(name)  
> if user  
> expected\_password = encrypted\_password(password, user.salt)  
> if user.hashed\_password != expected\_password  
> user = nil  
> end  
> end  
> user
> 
> create\_new\_salt  
> self.hashed\_password = User.encrypted\_password(self.password, self.salt)  
> end  
> private  
> def self.encrypted\_password(password, salt)  
> string\_to\_hash = password + “wibble” + salt # ‘wibble’ makes it harder  
> to guess  
> Digest::SHA1.hexdigest(string\_to\_hash)  
> end  
> def create\_new\_salt  
> self.salt = self.object\_id.to\_s + rand.to\_s  
> end  
> end
> 
> TIA.

You can be more secure. Store in the database encrypted salt

def create\_new\_salt  
self.salt = Digest::SHA1.hexdigest(self.object\_id.to\_s + rand.to\_s)  
end

and even more - do the same whith password before concatenate it with  
salt.  
and even more - use Digest::SHA1.hexdigest for password and salt  
and Digest::SHA256.hexdigest for hashed\_password ( require  
‘digest/sha2’)