Is there any real standard for hashing when working with user passwords in non-web based software development?
I've only really ever handled passwords in Php before, where hashing is a must given the open availability of the web.
In an application that purely acts as a front end to a DB stored locally, with no interaction with the internet (at least not where passwords are concerned), how are passwords stored and handled? Surely they're not stored as plain text as that seems like a terrible idea regardless of how secure systems are. At the moment, the best I've got is storing a Hashed password and a separate Salt in the DB. In my experience even storing the salt separately is bad practice.
I also can't find much documentation when it comes to practices to a non-web based solution. I've had to perform a number of conversions and manipulating the password manually to actually work with the namespace (system.security.cryptography).
Given how not every developer can be expected to care enough to go through the effort, I'd have expected there to be a number of libraries and tools to help make the task as straightforward as possible.
Edit: Just for clarification, I'm looking for how these practices change (if any change) for local applications, and whether or not there is a separate standard to follow for working in a local environment.
(I'm working with C#.NET btw if that changes anything)
