0

If a user wants to login to a system/server, it's recommended to have the hashed&salted password saved in a database, along with its salt.

So the user wants to login, types in the password, clicks on login and with his input and the salt the system checks if the correct hash is created.

I understand this part.

But when I don't want to type the password every time, how would I save the password on client-side? I can't save it hashed, because I need to salt the clear password for the checkup. If I save it clear, the client is vulnerable. And if I use any encryption where do I store the "master-password".

Also in my case I don't really want the user to force into creating a master-password. Though it's a required feature not to type in the password every time.

Edit:

Second Question:

Well, one question I still have on my mind. How is it done in smartphones? For example your wifi password. You enter it once, it's stored on the device, but how is it secured? Do you know that?

2

Well, that's what password managers (provided by OSes or embedded in browsers) are for. And yes, you'll need a master password because you need some secret shared with the password manager for it to encrypt those previous passwords of yours. :)

Most websites would provide you with the ability to stay connected via cookies to spare you the pain of re-authenticating. This avoids exposing your credentials, though the cookies being stolen could lead to identity forgery.

  • Well, one question I still have on my mind. How is it done in smartphones? For example your wifi password. You enter it once, it's stored on the device, but how is it secured? Do you know that? – Loki Jul 15 '14 at 7:59
  • @Loki The wifi password(s) on an android device are essentially unsecured - they are stored in a plain text file, and use linux permissions to restrict access to non-root apps, however that means that any app with root access CAN read the plain-text password file edit: the file is data/misc/wifi/wpa_supplicant.conf – user2813274 Jul 16 '14 at 18:41
  • Do you know if any systems allow an accounts to have a "user" password but also be instructed to accept some other form of credential when an automated process is communicating with it? I would think that passwords should really only be used for things that people will have to be typing. Otherwise things like challenge/response protocols would seem much better for automated connections. – supercat Aug 24 '14 at 0:24
  • The point of passwords and other knowledge-based authentication factors is to verify the identity of a human operator. Other factors based on what you are or what you own can be automated much more easily (implicit authentication based on biometrics, physical tokens, etc.) – Steve Dodier-Lazaro Aug 24 '14 at 2:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.