I am hashing and storing the salt:hash of each user's password in our database. The web server is ASP.NET and the connection string to the database in web.config is encrypted using the IIS config encryption.

I could also encrypt the salt:hash before storing it. But the encryption key would also be in web.config, also encrypted using the IIS config encryption.

This strikes me as no additional protection. If someone gets the unencrypted connection string from our web.config, then they can get the encryption key too.

Am I missing anything or would this be an extra step for no extra protection?

  • If it's not a hit to your system, it never hurts to make it harder for an attacker to get to sensitive data. – RoraΖ Sep 30 '14 at 17:51

There are times when an attacker might have access to retrieve data from your database (e.g. SQL Injection) but not have enough access to extract the encryption key from your web.config. In these situations this practice would add another layer of defense against user credential cracking.

It definitely isn't foolproof since a compromise at the server OS level could allow the attacker to extract encryption keys along with the user database. An attacker might also be able to run commands through SQL injection that provide access to the web.config data.

Whether it's worthwhile is a judgement call you'll have to make. It will add some overhead and complexity to your authentication process for a slight security improvement. If your credential database is compromised you will be able to tell your users that you don't think their passwords were exposed -- assuming you know for sure the key wasn't stolen -- but you'll probably still instruct them to create new passwords to be safe.

Adobe encrypted their customer passwords, and while millions of them were leaked a year ago there still hasn't been a public disclosure of the encryption key. These credentials might still be considered protected if it weren't for the accompanying password hints that often blatantly explained what likely password was used.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.