Is the MySQL password function vulnerable to this?

Question

Is storing a password in the DB using MySQL's password function just as bad as this?

http://money.cnn.com/2012/06/06/technology/linkedin-password-hack/?source=linkedin

The problem with SHA-1 is that it translates the same text the same way each time. So if your password is "password" and your friend's password is also "password," they will be hashed exactly the same way. That makes reversing the process to uncover the original password significantly easier.

I know it says SHA-1, but obviously any unsalted one way hash would have the same issue.

Answer 1

Is storing a password in the DB using MySQL's password function just as bad as this?

Yes.

Generally speaking you want to use a method that includes a salt, preferably unique for each user, and is slow to run to prevent brute force cracking. Bcrypt is the currently recommended way to go when storing passwords because it is intentionally (relatively) slow to create.

Answer 2

MySQL documentation says that you shouldn't be using the PASSWORD() function in your own application:

The PASSWORD() function is used by the authentication system in MySQL Server; you should not use it in your own applications.

Internally, MySQL's PASSWORD() function utilizes SHA1(2), that's SHA1 twice. However, it doesn't utilize a salt. So, yes, it's still vulnerable to rainbow table attacks.