Tag Info

New answers tagged

0

One of the main reasons for hashing passwords and not encrypting them is that people tend to reuse passwords (or minor variants) across many sites. So a password disclosure puts your site at risk and the user across all sites that they've (foolishly) reused that password. A better strategy is to obtain a temporary piece of data for the user that securely ...


0

Perhaps the app should use Kerberos to authenticate to the server, as well? E.g. using constrained delegation. Alternatively it could have a SSH key of its own, one that works for all accounts but only from the webapp server's address.


0

There are three issues about that procedure: What if the encryption key is compromised? Are you going to use the same key to encrypt all passwords ? Adobe's system uses a different key so that if a key is compromised only one user would be affected. Storing sensible data such as, in your case, a part of the data used for your cryptography process in ...



Top 50 recent answers are included