2 ms·

Hashed password are pretty obvious, but what if your app needs to talk with something that needs original password (database, external system of some sort)? I

• Joakal 16y ago
  If you are using something like app -> db calls to be done automatically on a server, hashed passwords won't help since the script usually requires a stored non-hashed key unless it accepts hashed keys. Even then, if the password or hashed password is exposed, the hacker can still use it to access the database via your app. Maybe you want decentralised permissions of multiple database users? They can't quite get or do most things. Or centralised and/or put into a locked down file that can only be accessed by the OS user for parsing scripts eg www-data. More references: http://technet.microsoft.com/en-us/library/cc722487.aspx#EIAA http://technet.microsoft.com/en-us/library/cc722487.aspx#EIA... http://us.php.net/manual/en/security.php http://us.php.net/manual/en/security.php (Or check your relevant manual) http://blogs.forbes.com/firewall/2010/12/13/the-lessons-of-gawkers-security-mess/ http://blogs.forbes.com/firewall/2010/12/13/the-lessons-of-g... http://stackoverflow.com/questions/3173698/how-safe-is-code-hosted-elsewhere http://stackoverflow.com/questions/3173698/how-safe-is-code-...