I'm making a desktop application in C# and I want to know If I'm handling this (from security perspective) as should be or not.
My Users table have both
salt, both are binary(32).
To create a new account:
- The user type the login name, and the password
- A salt is randomly generated (this happens in the client side).
- The created salt will be used to hash the password (SHA256).
- The user types his password
selectstatement is made to the database to get the salt, hash the typed password using that salt and then compare to the database
My questions are:
- Is it a bad practice to have your password salt as
- Does it make sense to generate the salt in the application and then send it to the database? If not, why? (Only one user will have access to the creating accounts function, he'll create the accounts for everyone)
- Whether the bold part above is a bad practice?
Bcryptor similar functions. The point is to make the attacker spend substantial of time finding passwords by brute force.