I'm a web developer / sys admin and I'm reading about the security of (for example) MySQL user authentication for the web apps and any other use case that involves local authentication in this context, like a framework for an online game.
I've come across some questions and it seems that everyone agrees on using strong passwords for local MySQL users. I'm using the same thing for user/dbname/password (edit: only for development!).
My question is, if the user is only allowed to be used in
127.0.0.1, then, what is the purpose of the password? If someone gains access to the system then they can access the database files and get the passwords from the
.php files. Also, if a virus has infected the system it doesn't matter how strong the password is, again, it can access the files.
In what scenario would a (strong) local user password really protected the databases?
Would someone be so kind to explain this in detail? I'd appreciate it.