Tag Info

New answers tagged

1

Another problem that I see here that's also related to security: suppose one of your users has to change their password because they were infected with a keylogger or a phishing attack. How will you manage to do that? The only way you can is by asking them for their password, rehashing that password, then replacing it in your code, recompiling and then ...


4

That is actually far less secure. In an ideal world, where your database is not sitting in the DMZ but is instead only accessible directly from your web server, and then with limited account rights, in order to breach your database and retrieve your hashed password table, I have to: Expose your software database connection variables (account/password) by ...


26

A few points: What you mean with encrypting passwords in the DB is hashing. That´s a big big difference. The first reason why DBs are used instead of hard coding user data is not security, but simplicity (add/modify/delete users without recompiling etc.) Storing passwords in plaintext is a problem, doesn't matter if they are in your program or in the ...


10

Please, do not Hard Code credentials or hashes. Hardcoded passwords may compromise system security in a way that cannot be easily remedied. [...] it also makes fixing the problem extremely difficult. See OWASP page about Hard Coded Passwords [...]many hashes are reversible (or at least vulnerable to brute force attacks) - and further, many ...



Top 50 recent answers are included