101 reputation
2
bio website
location Southern California
age 27
visits member for 2 years, 2 months
seen yesterday

Software engineer specializing in node.js and test tools.


Jun
18
awarded  Supporter
Aug
8
comment Encrypting/decrypting information in database
@Nasir If the password is only stored as a hash in the database, what's the problem?
Aug
8
comment Encrypting/decrypting information in database
The security is only as good as the user's password/passphrase. Encourage them to use something sufficiently long and easy to remember, and your security will be fine.
Aug
8
comment Encrypting/decrypting information in database
You're right that using the hash as the decryption key is bad. To do it right, you need to require the user to re-enter the password, and use the plaintext to decrypt the key.
Aug
8
comment Encrypting/decrypting information in database
This is kind of a broad question, and the answer is a matter of opinion. Here's mine: If you want your users to feel more secure, let them create a second password just for decrypting. They can always use the same password as their login password, so it gives the paranoid users the peace of mind, while keeping it easy for the normal users.
Jun
15
awarded  Autobiographer