Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was using Lotus Notes today and I realized that the program asks password is encrypted in many ways. even without access to the stored passwords notes I can say that they are at least as recorded in 3 different ways:

  1. replaces the characters as you type your password: Type A but he writes in the field abc123.
  2. Generates a color for the password: password foobar generates the color blue.
  3. Generates an image.

With all that we can check the user with more security than just plain text password.

I want to know is not a good question, but tips ... How do you guys store these passwords?

Just hash? or in a hash and salt? or with more than a field to check?

I think the best way for me is:

  1. generate a salt and store it
  2. generate the password hash using the password in plain text and salt
  3. Using this string generated to calculate a color and a number from 1 to 10
  4. And store everything (salt, hash (salt & password), color, number)

So we need to sign the hash (salt & password) match while also matching color and number.

I know that security is never perfect, but this is a good solution?

what you think?

you guys have a better idea?

from now, thanks

EDIT

I'm sure Lotus Nores stores color and image, that's not the point

I'm not being specific to Lotus Notes, I would like a broader opinion that solutions can use in various languages ​​and different database.

I wonder if there is a solution for password storage better than the proposal.

hypothetically if I use md5 hash or secure hash, I do not care. I want to know is if this encryption solution is strong and if there is a better solution.

share|improve this question
1  
There are a range of questions already on the benefits and drawbacks of password storage methods, and this question does not fit our Q&A format. –  Rory Alsop Jul 22 '11 at 20:03
    
Also - Notes doesn't store colours etc - it generates them on the fly from the characters you type in. Password hash storage uses standard mechanism. –  Rory Alsop Jul 22 '11 at 20:04
add comment

closed as not constructive by Rory Alsop Jul 22 '11 at 20:02

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

Matching color and number? Are you sure that information is stored rather than calculated? I suspect only a password hash is actually being stored. The rest is probably determined on the fly by a client-side algorithm. You should only store, and can only verify information that is input by the user. Unless the user is selecting a color or image as part of the authentication process, that's probably just a flashy interface and not an authentication method. Your question needs more clarity on that for those of us who don't work with Lotus on a regular basis.

share|improve this answer
    
I'm sure Lotus Nores stores color and image. Each login is the password you submitted the calculations to determine the color and the image that password. I'm not being specific to Lotus Notes, I would like a broader opinion that solutions can use in various languages ​​and different database. I wonder if there is a solution for password storage better than the proposal. hypothetically if I use md5 hash or secure hash, I do not care. I want to know is if this encryption solution is strong and if there is a better solution. –  Nicos Karalis Jul 22 '11 at 19:56
add comment

You can store your password in many different ways, using a salt is probably a good idea.

But I think also that the use of a framework to store a password is the best way to store a password, because its ways of "creating" it as probably been reviewed by many people before. This allows you also to use a secure hash (not md5) or whatever else.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.