Timeline for How to encrypt all existing customer passwords [closed]
Current License: CC BY-SA 3.0
15 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Jan 16, 2015 at 20:23 | history | closed |
Jens Erat RoraΖ Steve D.W. schroeder♦ |
Not suitable for this site | |
Jan 16, 2015 at 18:37 | comment | added | CLo | Didn't see this mentioned anywhere. But you may want to consider forcing user password resets. Can you be sure that the plain text passwords aren't already exposed somewhere? Or do you have data backups that will have these plain text passwords? It's a risk to customer experience I know, but not nearly as big as having their password stolen. | |
Jan 16, 2015 at 18:01 | comment | added | Drunix | I agree that in this case hashing is the superior choice compared to encryption, but you always have to check that you don't need the password for challenge response schemes like CHAP. They don't work with hashed password (or are cheating like MS-CHAP where the password hash is as good for logging in as the password itself). | |
Jan 16, 2015 at 15:45 | answer | added | Michael | timeline score: 0 | |
Jan 16, 2015 at 15:27 | comment | added | dberm22 | Take a look at this answer. It has a nice in depth description of each step used for password hashing and why you shouldn't roll your own. Rely on a pre-existing implementation (written by experts) | |
Jan 16, 2015 at 15:18 | comment | added | Ryan McDonough | Also remember when you get round to encrypting all the passwords, you will need to update the login/register and any other user related code to implement the hashing choice you make. | |
Jan 16, 2015 at 14:49 | comment | added | Lawtonfogle | Read this post about passwords. | |
Jan 16, 2015 at 14:15 | answer | added | Xander | timeline score: 3 | |
Jan 16, 2015 at 13:21 | history | edited | Mike | CC BY-SA 3.0 |
added 505 characters in body
|
Jan 16, 2015 at 13:18 | answer | added | Bob Brown | timeline score: 5 | |
Jan 16, 2015 at 13:17 | comment | added | Bob Brown | I'm not the downvoter, but it is obvious that you haven't done any research at all before asking or you wouldn't be talking about "encrypting" passwords. | |
Jan 16, 2015 at 13:16 | comment | added | CodesInChaos |
You want to use a password hash (like PBKDF2), not encryption. Rfc2898DeriveBytes in .net. Use a per user salt and at least 10000 iterations.
|
|
Jan 16, 2015 at 13:08 | review | Close votes | |||
Jan 16, 2015 at 20:23 | |||||
Jan 16, 2015 at 12:46 | review | First posts | |||
Jan 16, 2015 at 12:49 | |||||
Jan 16, 2015 at 12:45 | history | asked | Mike | CC BY-SA 3.0 |