Re: Storing passwords in a database

Hi Mikael,

Mikael Lenfors wrote:

We have a user register in a SQL server database. The users passwords are
currently stored in varchar fields in clear text! We now want to store
these passwords in encrypted form. What is the best way to do this?

The best way is to not store the passwords at all if it can be avoided. If
you only need to verify them, use some kind of hash, that is: Store a hash
and verify a logon by calculating the hash of the password given by the
user and comparing it to the hash you stored in the database.

This means that there is no way of recovering the password (but also no way
of using that database to try and logon into other systems).

For changing the password:
1. Require the user to enter his old password and twice the new one.
2. Check the old password against your database, if it doesn't match, exit
3. Check whether the new passwords match, if not, exit
4. Check whether the new password meets your requirements (Length,
complexity, difference to the previous one (you just got that in step 1)
and lastly that it isn't one of the last n passwords the user had (by
comparing it to the hashes of these, see step 5), if it doesn't qualify,
exit
5. Store the hash of the old password so it will be available for step 4 in
the future
6. Store the hash of the new password

MfG
twm

.

Relevant Pages

  • Re: How to insert a parenthesis into a field
    ... scrambling the password is adequate to keep people from knowing that they ... scrambled password is altered, the hash won't work. ... Probably slows the database down a bit, ... store the string. ...
    (microsoft.public.sqlserver.server)
  • Re: LAMP - Program Design with Perl
    ... Does that mean that the second column of the database stores all ... > into a hash and then go through all possible parameters ... strings with the info needed to access the data base. ... could store the info needed to display the data. ...
    (comp.lang.perl.misc)
  • Re: CHECKSUM() question
    ... Basically I am creating a hash tables in a separate database, ... hashbytes, I think it will store the hashbyte value only once. ...
    (microsoft.public.sqlserver.programming)
  • Re: Hashtables
    ... You shouldn't store the hash *code* in a database or anything like ... just don't rely on it having the same hash code that ...
    (microsoft.public.dotnet.framework)
  • Re: Places to store a password
    ... If you need to retrieve the actual value of the password, ... in a database. ... You could also store it in the filesystem in a ... You never retrieve the password itself, but compare the hash ...
    (microsoft.public.dotnet.framework.aspnet)