Secure user authentication with one way password hash(galratner.com)
submitted by 
galratner(334) 10 months, 20 days ago
eeping users passwords in your database is a part of almost every application, yet securing passwords is rarely being done correctly.
I recently read an article by Coda Hale about the ineffectiveness of password salts. Coda Suggested using bcrypt to store passwords. He reasoned his argument by explaining bcrypt is extremely slow to compute, therefore making it slow to hack.
I completely agree, however, I wanted to add another way of safely storing passwords in a more conventional way by hiding the salt in the hash. The idea wasn’t mine. It belongs to a DBA named Scott Hulberg. It’s pretty simple and for the sake of this blog post I am not going to implement it completely. I am going to prepend the salt to the password hash, making it invisible to a hacker. You can go further by writing an algorithm to plant the salt in the hash array as you see fit.
Since the only way to match a one way hashed password is to use the salt we used to generate this hash, if a hacker cannot get to the salt, they cannot retrieve the original password.
Let’s begin by composing the method to create our hash and prefix it with the salt: read more...
|category: Security
|Views: 5
tags:
Security another
Everyones tags:
Your Tags: