Best ways to store a password Server side [closed]

Question

I was using Lotus Notes today and I realized that the program asks password is encrypted in many ways. even without access to the stored passwords notes I can say that they are at least as recorded in 3 different ways:

1. replaces the characters as you type your password: Type A but he writes in the field abc123.
2. Generates a color for the password: password foobar generates the color blue.
3. Generates an image.

With all that we can check the user with more security than just plain text password.

I want to know is not a good question, but tips ... How do you guys store these passwords?

Just hash? or in a hash and salt? or with more than a field to check?

I think the best way for me is:

1. generate a salt and store it
2. generate the password hash using the password in plain text and salt
3. Using this string generated to calculate a color and a number from 1 to 10
4. And store everything (salt, hash (salt & password), color, number)

So we need to sign the hash (salt & password) match while also matching color and number.

I know that security is never perfect, but this is a good solution?

what you think?

you guys have a better idea?

from now, thanks

EDIT

I'm sure Lotus Nores stores color and image, that's not the point

I'm not being specific to Lotus Notes, I would like a broader opinion that solutions can use in various languages ​​and different database.

I wonder if there is a solution for password storage better than the proposal.

hypothetically if I use md5 hash or secure hash, I do not care. I want to know is if this encryption solution is strong and if there is a better solution.

Answer 1

Matching color and number? Are you sure that information is stored rather than calculated? I suspect only a password hash is actually being stored. The rest is probably determined on the fly by a client-side algorithm. You should only store, and can only verify information that is input by the user. Unless the user is selecting a color or image as part of the authentication process, that's probably just a flashy interface and not an authentication method. Your question needs more clarity on that for those of us who don't work with Lotus on a regular basis.

Answer 2

You can store your password in many different ways, using a salt is probably a good idea.

But I think also that the use of a framework to store a password is the best way to store a password, because its ways of "creating" it as probably been reviewed by many people before. This allows you also to use a secure hash (not md5) or whatever else.