1

I am trying to work out the best way to secure user credentials for the login of the service i am working on. The safest way would be to use hashing and salting however this project requires the password to be decrypted so that the support staff can login to the users account (if the user opens a support ticket if something is not working right).

I have done some research and it seems like AES is the best option. My concern is how I should be storing the encryption keys on the server, because if the server is compromised then the hacker has access to the keys to decrypt all the credentials.

I would be grateful if someone could inform me on the best practices i should use for this project.

Side note: I am programming the backend in NodeJS and it will be running on a private linux VPS.

12

Generally, it's good practice to allow some other method of impersonation. By allowing administration staff access to passwords, you lose the ability to verify that a given user has performed a given action - it might be the original user, it might be your admin staff. It also compromises any users who happen to re-use passwords on your site and elsewhere - it would only take one admin user writing down the username and password, and finding the same details in use on another site.

If you must allow logging in as another user, the admin staff should reset the password to one they know, make whatever changes they need to do, then enforce a password reset when the user next logs in.

In short, don't do this - either implement another method of impersonation, which logs the admin user who accessed the account, the time, and what they did, or make use of your existing password reset processes, and ensure that the password known to the admin staff is changed the next time the user logs in.

  • Yes, this is an option I was considering. In any case, i was going to make their password automatically generated - not their own password, so if the database is comprimised then it wont affect their other accounts. – Andy Feb 6 '17 at 12:26
  • If they can reset the password to one of their choice (which is usually a good idea), that doesn't help... – Matthew Feb 6 '17 at 12:30
  • ok thanks for the help! I will use your advice to plan out a new system. – Andy Feb 6 '17 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.