I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it.
Believe, I know, there are hundreds questions about this issue. I read looots of them to find the SAFEST way to store a password but every answer given gives me that itchy sensation that we still can do much better. And I'm planning to use this in PHP but I think it applies to any coding language.
I'm no security expert but isn't only one method not secure enough?
If I understood correctly Encrypted password (with PHP) can be Decrypted back to plaintext if you know the string which was used. Most hosting accounts I've seen hacked first get access to the files and then looking for the DB password stored in config.php or so.
Even if I use a big and complicated string to encrypt the password, if the intruder goes to create_account.php (or wherever the user is created) s/he will find the string there and would be able to decrypt the whole password column in a few minutes (right?)
The good thing about hashing is that the password can't be returned to plain text, which is great but... Many hashing methods have exploits and I've been reading some articles that getting possible values for a hashing (a hash string can mean more than one plain text string). I read an article that said that some people were able to recover password from hashed using Amazon EC2 in seconds for weak passwords and hours for strong ones.
I even saw hashing index directories where hackers and random j*rks store huge amounts of hash>string values so if you enter the hash you got, you can get possible password in just one second. This is still some kind of dictionary attack but a pretty effective one.
For common hashed like MD5 I even saw an article in which a hacker easily found that Google somehow indexes MD5 hashes because of how much it is used (like in filenames, gravatar.com and alike APIs, etc) so he had an indexed HUUUGE dictionary of hashed that only take one second to associate to values.
MD5 and SHA1 were once believed to be secure but then exploits appeared. What if the trusted method used now (I read blowfish is the best one, is that correct?) gets some exploit in the future?
And lastly, I know this is ridiculous but I'm uncomfortable with the possibility of 2 passwords having the same hash result. I know, the possibilities of somebody guessing the other value that has the same hash is veeeeeery low, but HEY, we're in 2012!, weren't we supposed to have flying cars and computers that could render Avatar movie in an hour already? :P There should be something better already...
Even if I use a salt to make it harder for password retrieval, if the hacker sees the fixed salt string (or where the random salt was stored) it wouldn't make much more complicated to brute force with a cloud computational attack, would it?
ISN'T THERE SOMETHING BETTER?
As I said, I'm far from being a security expert but isn't there any option out there? I've read lots of questions about this here in Stack Overflow and Google result (which most are stack overflow answers :D ) and they pretty much always say the same thing.
If hashing and encryption are the only options, is a way to make it better? Is there a way to hide the encryption password in the case the file that creates the users gets accessed?
In all those answers I never saw somebody suggesting to combine methods like:
sha1(crypt[blowfish.salt],salt) Is this a bad idea for some reason? (I can only think of being too processor consuming in a site with thousands of users registering and loggin-in, but I can handle that in the sites I'm planning to use it)
I'm not asking "please code this for me", I want to know how to make it "as most impossible possible" (hardest :P) to get the passwords in the case the DB and Source Code got in the wrong hands
Maybe I misunderstood the way these methods work and maybe there's something like a PHP function to make a string undecryptable even with the password, or maybe I missed something. I still find it strange that nobody suggested a combination of methods.
Thanks in advance and thanks again if you're still reading my worried mind's thoughts