Skip to main content
added 405 characters in body
Source Link

As the others mentioned, a hashed (non-reversible) password is better because you can look at the database without the disclosure of the users password and slow down an attacker. But there are some other points that are possible when the password is only known by the account owner.

You can encrypt the data with a random key. The random key is then encrypted with the users password. Then only that user can get access, even if someone changes the hash in the database. The downside is of course that if the user forgets the password, all data is lost.

This can even extended with certificates. Everyone can encrypt, but you need the password (which is not reversible from the hash) to read it again.

Such an system would be defeated if you store the clear passwords. Such an system is not usual, but certainly possible. And in such a system, even with full r/w access, you have to intercept the password or the data to get to the data, changing the system, which requires a) a lot of time b) good knowledge of the system and is therefore not as easy.

Edit: Ubuntu uses the user password to de/encrypt the home directory as I described . If the passwords would be stored in clear text, the admin still could access the data. Sure, while the user is logged in or the system is changed to share the keys, copy the home directory etc, the data is not longer safe.

But hashing passwords is like wearing a bullet vest. You could still be shoot in the head.

As the others mentioned, a hashed (non-reversible) password is better because you can look at the database without the disclosure of the users password and slow down an attacker. But there are some other points that are possible when the password is only known by the account owner.

You can encrypt the data with a random key. The random key is then encrypted with the users password. Then only that user can get access, even if someone changes the hash in the database. The downside is of course that if the user forgets the password, all data is lost.

This can even extended with certificates. Everyone can encrypt, but you need the password (which is not reversible from the hash) to read it again.

Such an system would be defeated if you store the clear passwords. Such an system is not usual, but certainly possible. And in such a system, even with full r/w access, you have to intercept the password or the data to get to the data, changing the system, which requires a) a lot of time b) good knowledge of the system and is therefore not as easy.

As the others mentioned, a hashed (non-reversible) password is better because you can look at the database without the disclosure of the users password and slow down an attacker. But there are some other points that are possible when the password is only known by the account owner.

You can encrypt the data with a random key. The random key is then encrypted with the users password. Then only that user can get access, even if someone changes the hash in the database. The downside is of course that if the user forgets the password, all data is lost.

This can even extended with certificates. Everyone can encrypt, but you need the password (which is not reversible from the hash) to read it again.

Such an system would be defeated if you store the clear passwords. Such an system is not usual, but certainly possible. And in such a system, even with full r/w access, you have to intercept the password or the data to get to the data, changing the system, which requires a) a lot of time b) good knowledge of the system and is therefore not as easy.

Edit: Ubuntu uses the user password to de/encrypt the home directory as I described . If the passwords would be stored in clear text, the admin still could access the data. Sure, while the user is logged in or the system is changed to share the keys, copy the home directory etc, the data is not longer safe.

But hashing passwords is like wearing a bullet vest. You could still be shoot in the head.

Source Link

As the others mentioned, a hashed (non-reversible) password is better because you can look at the database without the disclosure of the users password and slow down an attacker. But there are some other points that are possible when the password is only known by the account owner.

You can encrypt the data with a random key. The random key is then encrypted with the users password. Then only that user can get access, even if someone changes the hash in the database. The downside is of course that if the user forgets the password, all data is lost.

This can even extended with certificates. Everyone can encrypt, but you need the password (which is not reversible from the hash) to read it again.

Such an system would be defeated if you store the clear passwords. Such an system is not usual, but certainly possible. And in such a system, even with full r/w access, you have to intercept the password or the data to get to the data, changing the system, which requires a) a lot of time b) good knowledge of the system and is therefore not as easy.