Re: Store database password

>We have a dilemma. We are storing our database password in an include
>file that resides outside of the web root. The password is in plain
>text. So, no one can get that password because it can't be served up
>by the web server. So far, so good.
>
>The customer wants all of our passwords encrypted. So, how do I go
>about securely encrypting that password? If I use mcrypt, I have to
>store a key and an IV somewhere...and if those are in clear text, I
>might as well just store the password in clear text. That is to say, I
>could encrypt the password with a given key and IV, and then hard code
>that key and IV into my app and put the encrypted password into the
>database. But, there's really no security in that.

You have to store <something> that will get you into the database.

Whatever that <something> is, it might as well be in plain text,
since by definition it gets you into the database, although you can
divide it up and scatter pieces of it around (which is security by
obscurity, which generally means not much security). If you further
encrypt, then the key to decrypt becomes part of the <something>
that HAS to be there to access the database.

Essentially, you're screwed, although some of the "security by
obscurity" techniques aren't 100% useless (having to calculate the
real password is a LITTLE harder than having it around in a file
somewhere).

Gordon L. Burditt
.

Relevant Pages

  • Re: Application security question
    ... you want to implement security. ... So you are protecting the database from direct querying and altering ... login credentials for the database from the application. ... Why encrypt the password? ...
    (comp.lang.java.programmer)
  • Re: Which is more secure RC2 or RC4 ?
    ... same database temporarily, until the order is approved manually and the ... obviously there are a LOT of security related issues that arise ... itself in order to decrypt the information, ... meaning if I encrypt the information using AES and a password driven ...
    (sci.crypt)
  • RE: protecting .NET assemblies from hackers
    ... try exposing a web service or a remote class.. ... So one thing to do here is use a code obfuscator to encrypt ... > edit data on basically every table in the database. ... >> other methods of security like domain authentication or using ssl. ...
    (microsoft.public.dotnet.general)
  • Re: Database encryption.
    ... > I am writing application that encrypt paradox type database with IDEA ... which is used to mark end of string. ...
    (sci.crypt)
  • Re: 2 Keys decrypts same message
    ... > I don't want to encrypt each row twice (with a admin password ... Keeping the database secret. ... lots of disk storage and high speed LAN (Local Area ...
    (sci.crypt)