2 Removed the unnecessary insult
source | link

Depends on just how secure it needs to be. Every time you make the solution more complex, you are also likely to leave a gaping hole. No offence intended here, but I'm guessing you're not an expert in security, based on the fact that you're asking the question. It's better to use some kind of industry standard authorisation and authentication module.

You will probably be fine, as long as you are:

  • encrypting the password (with something like AES or Blowfish)
  • salting the password
  • sending the data over HTTPS

An alternative is OAuth.

If somebody wants to hack you badly enough, they will always find a way. The secret is increasing the time and effort required enough that it's not worth the while of somebody doing it. Hence, if you don't have huge amounts of customer and/or financial data, and you're not a high-profile company, a standard security implementation like the above should be fine.

Depends on just how secure it needs to be. Every time you make the solution more complex, you are also likely to leave a gaping hole. No offence intended here, but I'm guessing you're not an expert in security, based on the fact that you're asking the question. It's better to use some kind of industry standard authorisation and authentication module.

You will probably be fine, as long as you are:

  • encrypting the password (with something like AES or Blowfish)
  • salting the password
  • sending the data over HTTPS

An alternative is OAuth.

If somebody wants to hack you badly enough, they will always find a way. The secret is increasing the time and effort required enough that it's not worth the while of somebody doing it. Hence, if you don't have huge amounts of customer and/or financial data, and you're not a high-profile company, a standard security implementation like the above should be fine.

Depends on just how secure it needs to be. Every time you make the solution more complex, you are also likely to leave a gaping hole. It's better to use some kind of industry standard authorisation and authentication module.

You will probably be fine, as long as you are:

  • encrypting the password (with something like AES or Blowfish)
  • salting the password
  • sending the data over HTTPS

An alternative is OAuth.

If somebody wants to hack you badly enough, they will always find a way. The secret is increasing the time and effort required enough that it's not worth the while of somebody doing it. Hence, if you don't have huge amounts of customer and/or financial data, and you're not a high-profile company, a standard security implementation like the above should be fine.

    Post Migrated Here from stackoverflow.com
1
source | link

Depends on just how secure it needs to be. Every time you make the solution more complex, you are also likely to leave a gaping hole. No offence intended here, but I'm guessing you're not an expert in security, based on the fact that you're asking the question. It's better to use some kind of industry standard authorisation and authentication module.

You will probably be fine, as long as you are:

  • encrypting the password (with something like AES or Blowfish)
  • salting the password
  • sending the data over HTTPS

An alternative is OAuth.

If somebody wants to hack you badly enough, they will always find a way. The secret is increasing the time and effort required enough that it's not worth the while of somebody doing it. Hence, if you don't have huge amounts of customer and/or financial data, and you're not a high-profile company, a standard security implementation like the above should be fine.