3 ms·
Simple rules for the bare minimum - never store plain text password - never store direct hash of password - use a salt (must be stored) and hash password and s
by jmspring 14y ago
Simple rules for the bare minimum
- never store plain text password
- never store direct hash of password
- use a salt (must be stored) and hash password and salt
Ideally salt and hash of password/salt are in different databases.
Avoiding MD5 is recommended, but if you are at the point of worrying about that, you have bigger issues.
- UnoriginalGuy 14y agoI agree with everything you said except the "store in two different databases" line. If someone has compromised your system responsible for handling authentication then presumably they'd have access to both databases regardless - unless you've designed some kind of complex API for generating the salt and secured that API behind a whole different set of security and authentication (which almost everyone is too lazy to do). The salt is just there to stop rainbow tables being generated, and if you're really evil to add computational overhead, it isn't meant to be used in a game of hide and seek.