3 ms·
> Obviously if somebody has root on your server ... ... then it's game over for you. But I guess intruders typically use either SQL-injection or somehow get th
by ExpiredLink 13y ago
> Obviously if somebody has root on your server ...
... then it's game over for you. But I guess intruders typically use either SQL-injection or somehow get the application password to access the password table. In both cases an unreadable table would thwart the intruder.
- Drakim 13y agoBut is it? If the only way your production server can check passwords is by sending hash(salt+pw+salt) and getting a true\false reply from a piece of external hardware...then even if an intruder got complete control though some exploit or injection, he wouldn't be able to dump the database for later cracking with rainbow tables.
- shabble 13y agoYou may have just re-invented the Hardware Security Module(HSM)[1] :-) See also [2] for a cute implementation using an Arduino to secure an AWS API key [1] https://en.wikipedia.org/wiki/Hardware_security_module https://en.wikipedia.org/wiki/Hardware_security_module [2] http://stefan.arentz.ca/signing-aws-requests-with-your-arduino.html http://stefan.arentz.ca/signing-aws-requests-with-your-ardui...