Is it okay to save passwords as base64 strings with no other hashing or encryption beforehand?

Question

I've just inherited a project where all the passwords on the server side are simply converted to base64 and put in the database. No salt, no hash, nothing. Just a simple db.Add(password.ToBase64) kind of process.

Surely anyone who gets their hands on that data can extremely easily decode it? Hence the usual salt/hash approach.

I questioned the decision to use base64 strings and was told:

Regarding password - If someone is already on your server, you are already under threat irrespective or the encryption you choose. Its same even with someone penetrates your SSL layer itself.

This seems to ignore the fact that hacking into a server is not the only way to access a database. It could be as easy as going through someone's unguarded computer, stumbling across a database backup and seeing the blindingly obvious base64 strings, then joyously converting them all to raw passwords.

I know this question is probably a little bit too open-ended for the ususal StackExchange format, but the issue doesn't seem to be very well covered on here with the question wording I've used. It's a pretty important topic so I thought I'd throw it up.

To me it's utterly obvious that passwords shouldn't be stored using only base64 conversion, but I'm still relatively new to all this so maybe I've missed something.

Thanks.

Answer 1

TLDR: Never store passwords as base64, so you are correct in that it is a very bad practice.

Surely anyone who gets their hands on that data can extremely easily decrypt it?

Well, there is nothing to decrypt. Base64 is not an encryption, it is an encoding. It's role is to make sure the password can be stored in the database nicely and special characters aren't a problem. It does nothing to protect the password. From security standpoint, it is exactly the same as storing it without any encoding.

This seems to ignore the fact that hacking into a server is not the only way to access a database.

That quote seems to ignore a lot of things. There are several reasons to hash passwords and they have nothing to do with preventing initial compromise of your server. As mentioned, hashing does nothing to prevent that. Here are some reasons to hash passwords:

1. If your system is temporarily compromised, it allows you to recover. Thing about this scenario. Your server is compromised and your database stolen. Yes, all the personal data about your customers is leaked, nothing to do about that. But if the passwords are hashed, you can just send an email to all your customers urging them to change their passwords once the compromise is resolved. You have some level of certainty, that the user who knows the password and has access to the email is the proper user, as the attacker does not have the passwords.
2. If your system is compromised, it protects your customer in case they use the same password on multiple services. The first thing an attacker may likely try to do with a leaked DB of plain-text passwords is try the email password combination on popular sites like Facebook.
3. Someone with legitimate access to the server may use someone else's password to mask his tracks. Imagine a scenario where an admin has full access to the server, but everything he does is logged. If he tries to do something nefarious, it would be easy to figure out it was him. But if he just pulls a password of a different users, that may not be easy or even possible to figure out.
4. Limit a compromise. An attacker that gained access to the DB may not have full access to the server. However, if he can pull admins password from the database and log as said admin or even just other users, he may get access he would not be able to get otherwise.