3 ms·

Reading comments in this thread have been very enlightening. I am wondering if there is a best practices or guidelines for password storage for web service ope

by akg_67 14y ago

Reading comments in this thread have been very enlightening. I am wondering if there is a best practices or guidelines for password storage for web service operators. I currently manage a web service that has about 1,000 registered users. I have taken the most restrictive path to storing password in database except I need to make sure user/password database is portable from one host to another. Reading the comments, I am getting the impression that such portability may not be a good thing. But then how can I migrate from one host to another or restore backups? Are there documented good practices for storing passwords in database that also allow portability.

jmspring 14y ago
Simple rules for the bare minimum - never store plain text password - never store direct hash of password - use a salt (must be stored) and hash password and salt Ideally salt and hash of password/salt are in different databases. Avoiding MD5 is recommended, but if you are at the point of worrying about that, you have bigger issues.
- UnoriginalGuy 14y ago
  I agree with everything you said except the "store in two different databases" line. If someone has compromised your system responsible for handling authentication then presumably they'd have access to both databases regardless - unless you've designed some kind of complex API for generating the salt and secured that API behind a whole different set of security and authentication (which almost everyone is too lazy to do). The salt is just there to stop rainbow tables being generated, and if you're really evil to add computational overhead, it isn't meant to be used in a game of hide and seek.
tlrobinson 14y ago
Here's one http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ I'm not sure what portability issue you're referring to.
derobert 14y ago
You should become familiar with the Open Web Application Security Project https://www.owasp.org/ https://www.owasp.org/ , who are working on all kinds of best practices for web apps. OWASP has a draft on password storage https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet and also one on password complexity https://www.owasp.org/index.php/Password_length_%26_complexity https://www.owasp.org/index.php/Password_length_%26_complexi... . They have plenty more, like guides on common security vulnerabilities, etc.

by akg_67 14y ago

jmspring 14y ago

Simple rules for the bare minimum - never store plain text password - never store direct hash of password - use a salt (must be stored) and hash password and salt Ideally salt and hash of password/salt are in different databases. Avoiding MD5 is recommended, but if you are at the point of worrying about that, you have bigger issues.

UnoriginalGuy 14y ago
I agree with everything you said except the "store in two different databases" line. If someone has compromised your system responsible for handling authentication then presumably they'd have access to both databases regardless - unless you've designed some kind of complex API for generating the salt and secured that API behind a whole different set of security and authentication (which almost everyone is too lazy to do). The salt is just there to stop rainbow tables being generated, and if you're really evil to add computational overhead, it isn't meant to be used in a game of hide and seek.

tlrobinson 14y ago

Here's one http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ I'm not sure what portability issue you're referring to.

derobert 14y ago

You should become familiar with the Open Web Application Security Project https://www.owasp.org/ https://www.owasp.org/ , who are working on all kinds of best practices for web apps. OWASP has a draft on password storage https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet and also one on password complexity https://www.owasp.org/index.php/Password_length_%26_complexity https://www.owasp.org/index.php/Password_length_%26_complexi... . They have plenty more, like guides on common security vulnerabilities, etc.