New answers tagged python
One of the main reasons for hashing passwords and not encrypting them is that people tend to reuse passwords (or minor variants) across many sites. So a password disclosure puts your site at risk and the user across all sites that they've (foolishly) reused that password. A better strategy is to obtain a temporary piece of data for the user that securely ...
Perhaps the app should use Kerberos to authenticate to the server, as well? E.g. using constrained delegation. Alternatively it could have a SSH key of its own, one that works for all accounts but only from the webapp server's address.
There are three issues about that procedure: What if the encryption key is compromised? Are you going to use the same key to encrypt all passwords ? Adobe's system uses a different key so that if a key is compromised only one user would be affected. Storing sensible data such as, in your case, a part of the data used for your cryptography process in ...
Top 50 recent answers are included