0

Is there any real standard for hashing when working with user passwords in non-web based software development?

I've only really ever handled passwords in Php before, where hashing is a must given the open availability of the web.

In an application that purely acts as a front end to a DB stored locally, with no interaction with the internet (at least not where passwords are concerned), how are passwords stored and handled? Surely they're not stored as plain text as that seems like a terrible idea regardless of how secure systems are. At the moment, the best I've got is storing a Hashed password and a separate Salt in the DB. In my experience even storing the salt separately is bad practice.

I also can't find much documentation when it comes to practices to a non-web based solution. I've had to perform a number of conversions and manipulating the password manually to actually work with the namespace (system.security.cryptography).

Given how not every developer can be expected to care enough to go through the effort, I'd have expected there to be a number of libraries and tools to help make the task as straightforward as possible.

Edit: Just for clarification, I'm looking for how these practices change (if any change) for local applications, and whether or not there is a separate standard to follow for working in a local environment.

(I'm working with C#.NET btw if that changes anything)

|improve this question
  • While product recommendations are off topic on the forum, we can suggest some well known/followed guidelines. OWASP has certain guidelines on password storage: owasp.org/index.php/… – Limit Jul 6 '17 at 13:35
  • When you say "working with passwords" do you mean storing the password for resources that the application needs? Or storing passwords for users that log into the application? – crovers Jul 6 '17 at 14:00
  • @crovers storing passwords for users that log into the application. And whilst I'm not exactly looking for products, I'm curious as to how standard practices change when moving from web-based solutions to a basic, local application & DB. Sorry for the confusion, I'll try to edit my post to clear these up – lewis Jul 6 '17 at 14:04
  • In that case, @user52472 has a good answer for you – crovers Jul 6 '17 at 15:32
3

The standards would not really change from the web to local storage, with the exception of maybe some of the implementation details. Hashing is still a defense-in-depth technique to protect in the event of a compromised data store for both situations. The preference are still:

  1. If you can get away with it, don't store anything.
  2. If you need to store a password, hash with a salt using a Key Derivation Function (KDF)
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.