71
votes
Whats the safest way to store a password in database?
Hashing the salt doesn't really help, because the point of a salt is to be unique, not secret. Using usernames as a salt isn't great either, because the salts should be globally unique, and usernames ...
- 14.7k
17
votes
Accepted
What's the best format or way to generate a short-lived access token?
Your description of the authentication procedure is a bit concerning. If you only hash the password client-side and store this hash on the server for verification, then you've effectively created a ...
- 17.9k
10
votes
Whats the safest way to store a password in database?
I also read that good practice is that you need to add a nonce to the password-salt-hash and hash that too. This is done so no replay attacks can be carried out.
This seems to be about a login ...
- 33.4k
9
votes
Whats the safest way to store a password in database?
The safest way is to not store the password at all. Where possible use standards like OIDC or OAuth 2.0 to avoid the need for storing a user's password.
If you really need to store passwords, use a ...
- 478
4
votes
Whats the safest way to store a password in database?
This is not secure.
First off, as Sjoerd already pointed out, your question title about storing a password hash is detached from the question text which deals with a password-based authentication ...
- 17.9k
2
votes
Is there a private, secure and easy login system?
The answer is WebAuthn.
I don't know what your concerns over the privacy of WebAuthn are, but I don't see it. The link you posted - to privacy considerations - just demonstrates the fact that WebAuthn ...
- 478
2
votes
Accepted
Is there an attack vector for SMS verification code using a bunch of parallel requests
The attack you describe is essentially password spraying with extremely weak passwords, so this is a valid approach.
However, your probability calculations are incorrect. The probability that at least ...
- 17.9k
1
vote
Can I sufficiently protect my REST Service using shared Tokens?
Yes, this is acceptable.
Some people think that using short-lived sessions is more secure than using a fixed API token on every request. I am not one of those people so I cannot explain why, but this ...
- 33.4k
1
vote
Accepted
How do macOS Touch ID and Windows Hello work securely with fingerprints in place of passwords?
In general, an operating system needs to trust internal hardware. There are ways to make that trust stronger or weaker, for example by requiring a cryptographic key for authentication between the ...
- 50.4k
Only top scored, non community-wiki answers of a minimum length are eligible