Yii Demo app uses MD5 to hash password, thus suggests users, that this is safe and secure enough. I thought exactly the same. Up until now.
What do you think about this readout:
http://php.net/manual/en/faq.passwords.php#faq.passwords.fasthash
Shouldn’t we update autogenerate Yii demo to not use MD5 or at least add link to above text as a comment?
Thanks for your updates 
Well i am using these methods in my User Model class for Encryption of password.
public function encryptPassword($password)
{
return trim(base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256,$this->salt,$password, MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND))));
}
public function decryptPassword($password)
{
return trim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256,$this->salt, base64_decode($password), MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND)));
}
What you think, Is this encryption algorithm is secured and should be used in Yii Demo app.
i would like to know your suggestion.Since, i am using that code in my applications and its seems good so far.
Looking forward to hear from you.
Thanks in Advance.
md5 is not secure for long time. If you want something more secure try CPasswordHelper which is new with yii 1.1.14. It uses crypt(3) which is better but many reports shown that it’s not as secure as we could think… The best way would be to use PBKDF2 with sha256
http://www.yiiframework.com/news/72/yii-1-1-14-release-candidate-is-available/
However as it’s just for demo… I’d say that we don’t care a bit and of course it is clearly not recommended to keep this kind of login process for any yii application.
Demo of Yii 1.1.4 has been updated 
https://github.com/yiisoft/yii/commit/60e9e0e73ddc96336351ef66f9894cac6aab12a7
There’s built-in PBKDF2 support in PHP >= 5.5.0, however it says:
[i]
The PBKDF2 method can be used for hashing passwords for storage (it is NIST approved for that use). However, it should be noted that CRYPT_BLOWFISH is better suited for password storage and should be used instead via crypt(). [/i]
I am using the phpass extension, works well enough and uses blowfish algorithm.
Indeed, for many reasons using MD5 for storing password in the DB wasn’t considered safe for some time, but, we all find out things at our own pace.
I recommend this very good read about the reasons for not using MD5 for such purpose and possible other solutions.
I personally use PhpAss extension for handling passwords in Yii.
Boaz.
CodeSutra: I wouldn’t take that approach for passwords. You don’t want to encrypt the password, you want to hash the password. You never decrypt a password. You should use a one-way hashing algorithm or set of algorithms to generate a hashed password. When you want to test your password, run it through the algorithm and then check against the saved hash. If they match, you guessed correctly and you have access to whatever.
The reason MD5 and the standard SHA series by themselves are not good for password hashing algorithms is because they are very fast algorithms. People suggest using PBKDF2, bcrypt, or scrypt because those algorithms are intentionally time expensive for generating a key. If I pull your hash from the database and it is an MD5, I can feed it to John the Ripper and let it make millions of guesses per second, whereas, the other algorithms may make hundreds/sec. What is even worse, the MD5 and SHA-1 don’t use memory and can be fully parallelized, so you want to throw tons of GPUs at them to drastically improve your guess rate. The other algorithms are written to use memory, so your GPUs can’t utilize parallelization well. They have to fight over the shared memory resulting in wait time. For more info, check out Thomas Pornin’s response on “Why can’t one implement bcrypt on CUDA” on StackOverflow. He knows this stuff.
Sorry to say this, but as shness explained you in details, using any method of securing passwords, that is two-way algorithm (which means password can be read or decrypted at some point) is a complete mistake and misunderstanding of basic security concepts.
You (anyone) should ever, never be able to read password again, once it is stored in database. You should use any method, where you hash (crypt) what user has provided and you compare always hashed (crypted) strings, never unencrypted ones.
@all: Sorry for misspelling idea, but I’m neither not talking about Yii demo app itself nor about Blog example. I’m talking about Yii autogenerated app, that is done using yiic -webapp.
So, this isn’t a “small problem”, limited only to demos or examples as some suggests. This is quite “big problem”, because people are often using yiic to generate base for their new, at some point live and production, versions of their apps.
@ekerazha: Thanks for updating demo / blog app, but what we really need is to fix, what yiic is generating. Application generated this way also uses MD5, AFAIK.