If I have a database that stores the login credentials of 1,000,000 users in PLAINTEXT, how much effort will it take me to md5 hash these passwords?
After some tinkering I generated for you a quick and dirty solution
CONSIDERATIONS BEFORE DOING THIS::
- First create a back up of your table, (By using this code you hold yourself fully accountable for all damages)
- Secondly as mentioned by other users consider a different hash other than MD5
- Consider Thorbjørn Ravn Andersen comment on learning how to do commit and rollbacks and update the code provided accordingly.
- Finally consider adding some salt and pepper for taste.
The basic concept:
SQL:: 1 UPDATE 2 TABLE AS TARGET 3 INNER JOIN 4 TABLE AS SOURCE 5 ON 6 TARGET.id = SOURCE.id 7 SET 8 TARGET.[password_field_name] = md5(SOURCE.[password_field_name]) 9 WHERE 10 TARGET.id = SOURCE.id
What this essentially does is link the table with the password to itself with an inner join. It uses the aliases (Target and Source) to differentiate between the two copies of the table. Then using the regular Update syntax from sql, the Set statement on lines 7 and 8 causes the password field in the original table to become equal to the MD5 hash of the same password. To make sure that this sql only acts on a per row basis we establish the where statement using the primary key of the table.
Please don't convert it to MD5; it's not considered a secure hashing scheme.
If you're going to convert them to something else; then I'd suggest reading up on Password security. The topic is way too long to go into detail here.
Also, could you tell us the company so we can be sure not to store our credentials there?
Your effort = the same as if it were 10 rows. Just convert one, and put it in a loop.
Computers effort = effort (time) of converting one row * 1000000
The exact execution time of creating a md5 from plain text is a measurable value. The exact execution time of converting them all is predictable from the first result.
I reckon that your own effort would actually mostly be spend to the other parts of your login system and not this one, like forgotten password and similar. E.g. if the previous system used to send exact password to users, you'll have to replace it with a password reset functionality.