0

I am currently managing a network of around 100 PCs.
Many users have different mails/usernames and passwords for different services like login to PC, mail, local applications...

When an application or service enables auto-remember usually the users forget their login credentials.
Instead of requesting a password reset every time I was thinking to store the data inside a local SQL database. I would use an encryption algorithm on the data before storing.

Would this be safe enough or should I use another approach to storing user information ?

Improve this question
1

1 Answer 1

Reset to default
3

This is a risky idea. If someone manages to get access to your database and somehow cracks the encryption, they have access to the data of all users. Add to that that users often re-use passwords, and our hypothetical cracker has a treasure trove of valuable information.

Resetting passwords may be a bit of work, but it is the safer way of doing things.

Another thing you can do, is encourage your users to use a Password Manager program.

Improve this answer
10
  • 2
    it doesn't matter where you store the data. You should take care how you store it.
    – Danny.
    Jun 17, 2015 at 12:21
  • 1
    @Shawn: no offense, but if your this ignorant about password security, the last thing you should be doing is implementing your own password manager. If you really have to, use a proper password manager.
    – Lie Ryan
    Jun 17, 2015 at 12:48
  • 1
    @Shawn: security by obscurity is not a good bet to make. Take care that a lot of people uses weak passwords and reuses their passwords on multiple sites. Leakages from your low security application might end up with more serious breaches if the user has been reusing passwords they store in your home brew password manager with their other important accounts. Mature password manager programs comes with browser plugins and integration plugins for things like autofilling and strong password generator, which are security and usability pluses as well.
    – Lie Ryan
    Jun 17, 2015 at 13:17
  • 1
    @Lie Ryan, didnt think that user reuse their passwords. Will look in proffesional software. Thanks to all of you
    – Shawn
    Jun 17, 2015 at 13:19
  • 1
    @S.L.Barth: even when taking into account the LastPass debacle, they are still much more secure than the home brew password managers the OP is proposing (LastPass encrypts the password client-side, so the impact of the breach seems to be fairly minimal). If you really need to take your password managers with you, properly implemented cloud-based managers can be a convenient trade off.
    – Lie Ryan
    Jun 17, 2015 at 13:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .