I was using Lotus Notes today and I realized that the program asks password is encrypted in many ways. even without access to the stored passwords notes I can say that they are at least as recorded in 3 different ways:
- replaces the characters as you type your password: Type
Abut he writes in the field
- Generates a color for the password: password
foobargenerates the color blue.
- Generates an image.
With all that we can check the user with more security than just plain text password.
I want to know is not a good question, but tips ... How do you guys store these passwords?
Just hash? or in a hash and salt? or with more than a field to check?
I think the best way for me is:
- generate a salt and store it
- generate the password hash using the password in plain text and salt
- Using this string generated to calculate a color and a number from 1 to 10
- And store everything (salt, hash (salt & password), color, number)
So we need to sign the hash (salt & password) match while also matching color and number.
I know that security is never perfect, but this is a good solution?
what you think?
you guys have a better idea?
from now, thanks
I'm sure Lotus Nores stores color and image, that's not the point
I'm not being specific to Lotus Notes, I would like a broader opinion that solutions can use in various languages and different database.
I wonder if there is a solution for password storage better than the proposal.
hypothetically if I use md5 hash or secure hash, I do not care. I want to know is if this encryption solution is strong and if there is a better solution.