3 ms·
One method that I've thought about in the past is hashing your password using bcrypt, then zero and free the original password, and check all future authenticat
by FooBarWidget 14y ago
One method that I've thought about in the past is hashing your password using bcrypt, then zero and free the original password, and check all future authentication attempts against the bcrypt hash. Nobody, not even you, knows the password now, just whether a given password is correct.
- Mahh 14y agoHashing passwords for storage is standard practice in all systems that involve password based authentication. Even then, the password must reside in memory at some point in order to compute the hash of your password [using bycrypt or whatever scheme], which is necessary for both generating the hash the first time AND generating the hash for authentication attempts. This is the issue described in the given link. http://en.wikipedia.org/wiki/Cryptographic_hash_function#Password_verification http://en.wikipedia.org/wiki/Cryptographic_hash_function#Pas...
- mappu 14y agoOf course. But just using hashes doesn't mean you're safe - watch out for pass-the-hash and replay attacks, as well as session hijacking and other possible side channels.
- ars 14y agoThe question is about storing the password for you to authenticate to somewhere else, not the reverse. Storing a hash doesn't help because the remote site won't accept it. And if it did then the hash is essentially the password and you've violated the goal.