4 ms·
If your webserver machines are so secure, why put them in the database at all? Just store the passwords on disk there, rsync the password file across all machi
by mikebo 17y ago
If your webserver machines are so secure, why put them in the database at all? Just store the passwords on disk there, rsync the password file across all machines and you're set.
I kid, but I really think you and tptacek just have different standards. tptacek's is higher.
- tptacek 17y agoLots more web app flaws allow you to read arbitrary files than allow you to get a shell on the app server. There are cases where SQL Injection by itself is sufficient to get the contents of files. I think that's what bothers me most about using SHA1(k, nonce, password) as a hash. Well, that and the obnoxious trick question.
- ErrantX 17y agoIf your webserver machines are so secure, why put them in the database at all? You do put them on a web server. It just happens to run software optimized for extracting a particular entry from a large data set :) Ironically the way you suggest is more secure: because to compromise it (assuming the web app is out of the equation for the moment) requires a system exploit. Whereas you have the added complexity of the database as an additional weak point. EDIT: im confused about the downvote.. what in particular appears wrong (so I can explain it). Having Database software certainly lowers security on any system :) it's another failure point (any good security text book will explain that)