电子邮件也有md5吗？
我正在使用注册用户创建一个 MySQL 数据库，并且我想不仅将 md5 用于密码，也用于电子邮件 。
我认为这种选择可以提高用户安全性，但我还不是数据库专家，我不确定这是否明智！
我希望这不是一个愚蠢的问题！
I'm creating a MySQL database with registered users, and I'm thinking to use md5 not only for passwords but for e-mails too.
I think this choice can improve user security, but I'm not yet an expert with databases and I'm not sure if this is wise or not!
I hope this isn't a stupid question!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
您是否不希望稍后能够取回电子邮件地址，例如通过电子邮件向他们发送更新消息？散列是一种单向过程。
使用电子邮件地址的哈希值可以让用户输入其电子邮件地址来获取新的临时密码，这样您就可以立即获得该地址 - 但如果您稍后需要向他们发送电子邮件，则不需要还有更多信息吗？
Do you not want to be able to get the email addresses back later on, such as to email them with news of an update? Hashing is a one-way process.
Using a hash for the email address would work in terms of the user entering their email address to get a new temporary password, in that you would have the address right there and then - but if you needed to email them later, you wouldn't have the information any more.
如果您将电子邮件存储为 MD5 摘要，您将无法再向用户发送电子邮件...
If you store the emails as MD5 digests, you can't email your users anymore...
MD5 是片面的——它不能被尊重。对于密码来说，这是可取的 - 没有人能猜出密码。
对于电子邮件，则没有那么多 - 您将无法向您的用户发送电子邮件，只能确认它与之前输入的相同。
MD5 is one sided - it cannot be revered. For passwords, this is desireable - no one can figure out the password.
For emails, not so much - you will not be able to send emails to your users, only confirm it is the same as previously entered.
您不仅应该对密码进行 MD5 处理，还应该多次添加盐值和哈希结果密码，然后将盐和哈希字符串保存在数据库中。这样就更难猜测原始密码 - 这与您的安全无关（破解者可以以同样的方式暴力破解密码，但速度会慢一点，这是好），这关系到用户的安全。许多用户在多个站点使用相同的密码。更多信息请参见http://www.codinghorror.com/blog/archives/000953.html
You should not only MD5 your passwords, but add salt value and hash resulting password multiple times, then save salt and hashed string in database. That way it will be harder to guess original password - it's not about your security (cracker can bruteforce passwords same way, but it'll be a little slower, which is good), it's about users security. Many of users use same password in multiple sites. More info in http://www.codinghorror.com/blog/archives/000953.html
您可以使用 MD5 或 SHA-2 等单向哈希来签名消息，以使其更难伪造或更改，但没有实用的方法将哈希转换回来到一条消息中。
You can use a one way hash like MD5 or SHA-2 to sign a message to make it harder to forge or alter, but there's no practical way to convert the hash back into a message.