Re: Storing passwords in a database

"Mikael Lenfors" <mikael@xxxxxxxxxx> wrote in message
news:45618aa8@xxxxxxxxxxxxxxxxxxxxxxxxx
Hello!

We have a user register in a SQL server database. The users passwords are
currently stored in varchar fields in clear text! We now want to store
these passwords in encrypted form. What is the best way to do this?
[SNIP]

Store them as a hash (SHA-1, etc.). When the user logs on, hash the
password they entered and compare it to the value stored in the database.
Note that there is no way to recover passwords from such a system, you can
only reset them.

--
Ray Marron


.

Relevant Pages

  • Re: Decrypt
    ... that you store the encrypted passwords on the server. ... In fact, don't just hash the passwords, but combine the password ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Hacked Passwords
    ... a null hash starting with the AAD3 characters. ... store the older LM Hash format. ... passwords on pieces of paper. ...
    (microsoft.public.security)
  • Re: Is it necessary to store the entire MD5, etc. hash for validation?
    ... >I want to store the last 10 passwords used on a legacy database that, ... but I don't have room to store 10x128+ bytes. ... I think you are mistaken about the size of the output of hash functions, ... passphrase hashes if you use SHA-256, ...
    (sci.crypt)
  • Re: secure storage in Active Directory
    ... AD does not store user account passwords - it stores a hash of ... > I understand that the Active Directory stores user data and passwords. ... > How does it store these securely within its internal structure? ... they store the password hash. ...
    (microsoft.public.win2000.security)
  • Re: secure storage in Active Directory
    ... AD does not store user account passwords - it stores a hash of ... > I understand that the Active Directory stores user data and passwords. ... > How does it store these securely within its internal structure? ... they store the password hash. ...
    (microsoft.public.security)