Skip to main content
15 events
when toggle format what by license comment
Jan 16, 2015 at 20:23 history closed Jens Erat
RoraΖ
Steve
D.W.
schroeder
Not suitable for this site
Jan 16, 2015 at 18:37 comment added CLo Didn't see this mentioned anywhere. But you may want to consider forcing user password resets. Can you be sure that the plain text passwords aren't already exposed somewhere? Or do you have data backups that will have these plain text passwords? It's a risk to customer experience I know, but not nearly as big as having their password stolen.
Jan 16, 2015 at 18:01 comment added Drunix I agree that in this case hashing is the superior choice compared to encryption, but you always have to check that you don't need the password for challenge response schemes like CHAP. They don't work with hashed password (or are cheating like MS-CHAP where the password hash is as good for logging in as the password itself).
Jan 16, 2015 at 15:45 answer added Michael timeline score: 0
Jan 16, 2015 at 15:27 comment added dberm22 Take a look at this answer. It has a nice in depth description of each step used for password hashing and why you shouldn't roll your own. Rely on a pre-existing implementation (written by experts)
Jan 16, 2015 at 15:18 comment added Ryan McDonough Also remember when you get round to encrypting all the passwords, you will need to update the login/register and any other user related code to implement the hashing choice you make.
Jan 16, 2015 at 14:49 comment added Lawtonfogle Read this post about passwords.
Jan 16, 2015 at 14:15 answer added Xander timeline score: 3
Jan 16, 2015 at 13:21 history edited Mike CC BY-SA 3.0
added 505 characters in body
Jan 16, 2015 at 13:18 answer added Bob Brown timeline score: 5
Jan 16, 2015 at 13:17 comment added Bob Brown I'm not the downvoter, but it is obvious that you haven't done any research at all before asking or you wouldn't be talking about "encrypting" passwords.
Jan 16, 2015 at 13:16 comment added CodesInChaos You want to use a password hash (like PBKDF2), not encryption. Rfc2898DeriveBytes in .net. Use a per user salt and at least 10000 iterations.
Jan 16, 2015 at 13:08 review Close votes
Jan 16, 2015 at 20:23
Jan 16, 2015 at 12:46 review First posts
Jan 16, 2015 at 12:49
Jan 16, 2015 at 12:45 history asked Mike CC BY-SA 3.0